The EU AI Act's model rules, one year in: what changed, who signed and who enforces

The general-purpose AI model provisions of the EU AI Act, Chapter V of Regulation (EU) 2024/1689, have applied since 2 August 2025. On 2 August 2026 the Commission’s AI Office gained the power to demand documents, evaluate models and impose fines of up to 3% of worldwide turnover. A month later it sent its first formal requests for information to more than 30 providers. The rules that spent two years as a policy debate are now an operating regime with a supervisor, a voluntary code that most large labs signed, and a first enforcement file.

This explainer sets out what the regime actually requires, using the article numbers, thresholds and dates from the primary texts. It is written for people who build with these models: the lab shipping weights or an API, the team fine-tuning an open-weight model, and the far larger group calling a hosted model and wondering what, if anything, lands on them. It is not legal advice; it is a map of where the obligations sit as of late September 2026.

The short version: if you train a model above 10^23 FLOP and offer it in the EU, you are a provider and Article 53 applies. If you only fine-tune, you are almost certainly not. If you only call an API, Chapter V does not touch you directly, but the AI system rules in Article 50 do, and your upstream provider’s paperwork is now your paperwork too.

The timeline, and what the Digital Omnibus did and did not move

The AI Act entered into force on 1 August 2024 and phases in by chapter under Article 113. The general-purpose model rules came early, ahead of the high-risk system rules, because the Commission wanted the most capable models covered before the systems built on them. The Digital Omnibus on AI, Regulation (EU) 2026/1744, then moved several later dates but not the model dates. The table below is the consolidated position as of September 2026.

Two things stand out. First, the model rules were never delayed. The Omnibus was proposed by the Commission on 19 November 2025 as COM(2025) 836, agreed in trilogue on 7 May 2026, adopted by Parliament on 16 June 2026 by 423 votes to 57 with 174 abstentions, adopted by the Council on 29 June, signed on 8 July, published in the Official Journal on 24 July and in force on 27 July 2026. Across that whole process, Chapter V, the 10^25 FLOP threshold, the Article 101 fine ceiling and the 2 August 2027 deadline for older models were not amended. We checked the published text and found no change to Articles 51 to 56, Article 101 or Article 111(3).

Second, the one-year gap between obligations applying and fines becoming available was deliberate. Article 113(b) brought Chapter V into application on 2 August 2025 “with the exception of Article 101”, and the Commission’s guidelines describe the intervening year as a period of collaboration, especially with signatories of the Code of Practice. That year is over.

Who counts as a provider

The Act regulates providers of general-purpose AI models. Article 3(63) defines such a model as one “that displays significant generality and is capable of competently performing a wide range of distinct tasks”, trained on broad data at scale. Recital 98 adds an indication that models with at least a billion parameters, trained on large amounts of data with self-supervision at scale, should be treated as general-purpose. That is a wide net, so the Commission’s guidelines of 18 July 2025 supply a sharper, if still indicative, test.

The 10^23 FLOP criterion

The guidelines say a model should be presumed general-purpose when its training compute exceeds 10^23 floating-point operations and it can generate language (text or audio), text-to-image or text-to-video. Both limbs matter: a large model that only classifies images is not caught by the criterion, and a small generative model is not either. The Commission is explicit that the criterion is not absolute. A model above the line may “exceptionally not qualify” if it lacks significant generality, and a model below it may still qualify if it displays it. The Q&A that accompanies the guidelines gives the same formulation.

For orientation, 10^23 FLOP is roughly the training budget of a model in the low billions of parameters trained on a few hundred billion tokens. Almost every language model that a company would bother to release as a product sits above it. The threshold is meant to exclude narrow research models and small task-specific networks, not to exclude anything a builder would call an LLM.

Placing on the market

A provider is the entity that develops a model, or has it developed, and places it on the Union market under its own name (Article 3(3)). “Placing on the market” is the first making available in the Union (Article 3(9)), and “making available” covers supply for distribution or use in the course of a commercial activity, “whether in return for payment or free of charge” (Article 3(10)). The guidelines list the channels that count: an API, a download, a software library, a cloud service, and integration into the provider’s own application or system that is then offered in the EU. A model used purely for a company’s internal processes, where those processes are not essential to a product or service offered to third parties and do not affect the rights of people in the Union, is not placed on the market. That is a narrow exception and most production deployments fall outside it.

Article 2(1) makes the regime extraterritorial: it applies to providers placing models on the Union market “irrespective of whether those providers are established or located within the Union or in a third country”. Article 54 adds a practical consequence for providers outside the EU: they must appoint an authorised representative established in the Union before placing a model on the market. The representative verifies that the technical documentation exists, keeps a copy for ten years, and answers to the AI Office. Open-source providers are exempt from this appointment unless the model carries systemic risk.

The fine-tuning question

The provision that generated the most anxiety in 2024 has turned out to be the most generous. The guidelines say a downstream actor who modifies or fine-tunes a general-purpose model becomes the provider of a new general-purpose model only when “the training compute used for the modification is greater than a third of the training compute of the original model”. Where the original compute is not known, the fallback is one third of the relevant threshold: one third of 10^23 FLOP for an ordinary model, one third of 10^25 FLOP for a systemic-risk model. The Commission’s own reading is that “most fine-tuning, adaptations, and minor modifications will not subject developers to the obligations for providers”.

A worked example makes the scale clear. Suppose a team takes a 70-billion-parameter open-weight model whose card reports roughly 7 × 10^24 FLOP of pre-training compute, and fine-tunes it on 50,000 instruction examples averaging 1,000 tokens. Using the standard estimate of six FLOP per parameter per token, that run costs about 2 × 10^19 FLOP, five orders of magnitude below the one-third line. The team would need to spend more than 2.3 × 10^24 FLOP, in effect a continued pre-training run on hundreds of billions of tokens, before the guidelines would treat it as a new provider. Even then, the guidelines say the resulting Article 53 obligations attach to the modification, not to the original model: documentation of what was changed, the data used for the change, and the compute of the change.

The practical rule is therefore: log your fine-tuning compute. It is the number that decides your status and it is cheap to record at the time and expensive to reconstruct later.

Figure 1: The first question is whether you are a provider, a modifier who has crossed the one-third compute line and become a provider, or a deployer with duties under the AI system rules instead.

The open-source carve-out and its limits

Article 53(2) exempts models “released under a free and open-source licence that allows for the access, usage, modification, and distribution of the model” whose parameters, including weights, architecture information and usage information, are made publicly available. The exemption covers only Article 53(1)(a) and (b), the technical file and the downstream documentation duty. It does not cover the copyright policy or the training-content summary, and it does not apply at all to a model with systemic risk.

The guidelines add the condition that the licence must permit those freedoms “without monetisation”. Recital 103 explains what that means: a component is monetised if it is “provided against a price or otherwise monetised, including through the provision of technical support or other services”, or through the use of personal data “for reasons other than exclusively for improving the security, compatibility or interoperability” of the software. Hosting the weights on an open repository is not, in itself, monetisation. Selling a paid support tier for the same weights, or gating them behind a licence that restricts commercial use to a degree an open-source definition would reject, is a different matter and the exemption is at risk. Our piece on open-weight models closing the gap covers why some labs choose to publish weights; the Act gives them a modest regulatory reward for doing so, on the condition that they mean it.

What every provider owes under Article 53

Article 53(1) sets four obligations. They are shorter than their reputation.

(a) Technical documentation. Draw up and keep up to date the technical documentation of the model, including its training and testing process and the results of its evaluation, containing at minimum the information in Annex XI, and provide it to the AI Office and national competent authorities on request. Annex XI section 1 asks for a general description (intended tasks, acceptable-use policies, release date, distribution methods, architecture and parameter count, input and output modalities, licence) and a description of the development process: training methodology and key design choices, the provenance and curation of training, testing and validation data, the computational resources used (measured in FLOP and training time), and known or estimated energy consumption.

(b) Information for downstream providers. Draw up, keep up to date and make available information and documentation to providers of AI systems that intend to integrate the model, so that they can “understand the capabilities and limitations” of the model and meet their own obligations. Annex XII lists the content, which overlaps heavily with the public parts of Annex XI plus integration instructions and information on the data used for training, testing and validation. Trade secrets are protected under Article 78. In practice this is what a thorough model card already contains, which is why our guide on how to read a model card is also a guide to reading Annex XII.

(c) A copyright policy. Put in place a policy to comply with Union copyright law, and in particular to identify and honour reservations of rights expressed under Article 4(3) of the 2019 Copyright Directive, “including through state-of-the-art technologies”. This is the text-and-data-mining opt-out. A rightsholder who reserves rights in a machine-readable way, most commonly through robots.txt, must have that reservation respected when the provider crawls for training data.

(d) A public summary of training content. Draw up and make publicly available a “sufficiently detailed summary” of the content used to train the model, according to a template provided by the AI Office.

Article 53(3) adds a duty to cooperate with the Commission and national authorities. Article 53(4) says providers may rely on codes of practice to demonstrate compliance until a harmonised standard is published, and that providers who neither adhere to an approved code nor follow a standard “shall demonstrate alternative adequate means of compliance” for the Commission to assess.

The training-content summary in practice

The template is the obligation with the most visible output, so it deserves detail. The Commission published the template and explanatory notice on 24 July 2025. Using it is mandatory. It has three sections:

1. General information: the provider and model, the modalities of training content, and the size of the training data per modality in broad ranges rather than exact figures.
2. List of data sources: publicly available datasets (named, if large), data licensed from third parties, data scraped from the internet, user data, synthetic data, and other sources. For scraped content the provider must name the crawlers used, the period of collection, and list “the top 10% of all domains that have been scraped from the internet”, or for SMEs the top 5% or 1,000 domains, whichever is lower.
3. Relevant data processing aspects: how the provider honoured rights reservations, and measures taken to remove illegal content.

The summary must be published when the model is placed on the market, and the Commission’s FAQ says it should be updated for materially significant changes and otherwise at intervals of about six months. Models placed on the market before 2 August 2025 have until 2 August 2027.

Compliance has been slow and uneven. A study submitted to arXiv on 26 February 2026 by Blankvoort, Pandit and Gahntz could find only five public summaries in the Commission’s template as of 12 January 2026, more than five months after the obligation applied. Reporting in March 2026 named Hugging Face, the Swiss AI Initiative and Microsoft among the early publishers and OpenAI, Google and xAI among those that had not yet published for their current models. A third-party tracker that archives summaries daily counted, as of 26 September 2026, 75 published summaries and 49 missing across 124 tracked models from 31 providers. We have not independently verified each entry, but the direction is clear: the large labs published late, and some models still have no summary. The 2 August 2027 deadline for older models is the reason this is not yet an infringement in many cases; for models released after 2 August 2025 it is.

Figure 2: Every provider carries the middle column. Open-weight releases skip the documentation column unless the model carries systemic risk, which adds the third.

The systemic-risk tier

Article 51 creates a second tier for general-purpose models with systemic risk. A model qualifies if it has “high-impact capabilities” assessed with technical tools and benchmarks, or if the Commission designates it, on its own initiative or after an alert from the scientific panel, using the criteria in Annex XIII (parameter count, dataset size and quality, training compute, modalities, reach measured as at least 10,000 registered business users in the Union, and so on).

The presumption

Article 51(2) sets the presumption: a model “shall be presumed to have high impact capabilities” when “the cumulative amount of computation used for its training measured in floating point operations is greater than 10^25”. The Commission can amend that number by delegated act under Article 51(3) as hardware and algorithms move, and can supplement it with benchmarks. As of September 2026 it has not. The guidelines clarify that “cumulative” means the compute of the whole training process including pre-training, synthetic data generation used for training, and fine-tuning, and that the estimate should be made and updated before training completes.

Every frontier release from the largest labs sits comfortably above 10^25 FLOP. The number is roughly the budget of a model in the hundreds of billions of parameters trained on tens of trillions of tokens. Open-weight releases from smaller teams almost always sit below it, which is why the open-source exemption and the systemic-risk tier rarely collide in practice.

Notification

Article 52(1) requires the provider to notify the Commission “without delay and in any event within two weeks” of the threshold being met or of it becoming known that it will be met. Because compute is cumulative, that moment can arrive mid-training, and the guidelines say the notification can and should be made before training finishes. The provider may attach “sufficiently substantiated arguments” that the model, despite the compute, does not present systemic risk; the Commission decides. A provider can ask for reassessment no earlier than six months after a designation decision. Article 52(6) requires the Commission to publish and keep updated a list of models with systemic risk, subject to trade-secret protection. We could not find such a list published as of this writing.

The four extra duties

Article 55(1) adds four obligations on top of Article 53:

• (a) Evaluation. Perform model evaluation “in accordance with standardised protocols and tools reflecting the state of the art, including conducting and documenting adversarial testing” to identify and mitigate systemic risks.
• (b) Risk assessment and mitigation. Assess and mitigate possible systemic risks at Union level, including their sources, that may stem from development, placing on the market or use.
• (c) Incident reporting. Keep track of, document and report to the AI Office and national authorities “without undue delay” relevant information about serious incidents and possible corrective measures. Article 3(49) defines a serious incident as one leading to death, serious harm to health, disruption of critical infrastructure, infringement of fundamental rights obligations, or serious harm to property or the environment.
• (d) Cybersecurity. Ensure “an adequate level of cybersecurity protection” for the model and its physical infrastructure.

Annex XI section 2 extends the technical file for these models with a detailed description of evaluation strategies and results, internal and external adversarial testing, model adaptations such as alignment and fine-tuning, and system architecture. As with Article 53, adherence to an approved code of practice gives a presumption of conformity until a harmonised standard exists, and a provider that does neither must show alternative adequate means.

The Code of Practice and who signed it

Article 56 asked the AI Office to facilitate a code of practice covering Articles 53 and 55, to be ready by 2 May 2025, with a fallback allowing the Commission to impose common rules by implementing act if no adequate code emerged by 2 August 2025. The General-Purpose AI Code of Practice was published on 10 July 2025, two months late, after a process the Commission says involved 13 independent experts as chairs and vice-chairs and more than 1,000 participants from model providers, SMEs, academia, rightsholders and civil society across several drafting rounds. The Commission and the AI Board confirmed it as an adequate voluntary tool at the start of August 2025, days before the obligations applied.

The Code has three chapters. The first two apply to every provider; the third only to providers of systemic-risk models.

Transparency, chaired by Nuria Oliver with Rishi Bommasani as vice-chair, has three measures. Signatories keep a Model Documentation Form for each model, retain previous versions for ten years after the model is placed on the market, publish contact details so downstream providers can request the documentation, and answer downstream requests within 14 days unless there is a legitimate reason for delay. The Form distinguishes what goes to the AI Office, what goes to downstream providers and what is public.

Copyright, chaired by Alexander Peukert with Céline Castets-Renard as vice-chair, has five measures: adopt and implement a copyright policy; only crawl lawfully accessible content, without circumventing paywalls or similar access controls, and exclude websites persistently found to infringe copyright; honour machine-readable rights reservations, “in particular” the Robots Exclusion Protocol; take proportionate technical safeguards to prevent the model producing infringing outputs; and designate a contact point for rightsholder complaints.

Safety and Security, led by Yoshua Bengio, Daniel Privitera and Nitarshan Rajkumar among its chairs and vice-chairs, has ten commitments. A signatory adopts a Safety and Security Framework and confirms it to the AI Office within four weeks of notifying the Commission under Article 52, and at least two weeks before placing the model on the market. It identifies systemic risks against a list in the Code’s appendix (chemical, biological, radiological and nuclear risk; loss of control; cyber offence; harmful manipulation), analyses them with evaluations and post-market monitoring, sets acceptance criteria with safety margins, applies safety and security mitigations, and produces a Model Report before placing the model on the market. Commitment 9 sets incident deadlines: an initial report within two days for disruption of critical infrastructure, five days for a serious cybersecurity breach, ten days for a death and fifteen days for serious harm to health, fundamental rights, property or the environment, with intermediate updates every four weeks and a final report within 60 days of resolution.

Who signed, and what they said

As listed on the Commission’s signatories page at the time of writing, 21 companies have signed the full Code: AI Studio Delta, Aleph Alpha, Almawave, Amazon, Anthropic, Black Forest Labs, Bria AI, Cohere, Domyn, Dweve, Fastweb, Google, IBM, LINAGORA, Microsoft, Mistral AI, Open Hippo, OpenAI, Pleias, ServiceNow and WRITER. xAI signed only the Safety and Security chapter, which the Commission notes means it “will have to demonstrate compliance with the AI Act’s obligations concerning transparency and copyright via alternative adequate means”.

The statements are worth reading for what the signatories reserved. Google’s Kent Walker wrote that Google would sign but remained concerned that “departures from EU copyright law, steps that slow approvals, or requirements that expose trade secrets could chill European model development”, and committed to working with the AI Office to keep the Code “proportionate and responsive”. Anthropic said the Code “advances the principles of transparency, safety and accountability” and that its Safety and Security Framework would build on its existing Responsible Scaling Policy. Meta’s Joel Kaplan wrote that “Europe is heading down the wrong path on AI”, that Meta “won’t be signing”, and that the Code “introduces a number of legal uncertainties for model developers, as well as measures which go far beyond the scope of the AI Act”. xAI’s post said it “supports AI safety and will be signing the EU AI Act’s Code of Practice Chapter on Safety and Security”, while calling the copyright provisions “clearly an over-reach”.

Not signing is not non-compliance. Meta’s Llama models, if placed on the EU market, remain subject to Article 53 and, above 10^25 FLOP, Article 55; the company must simply demonstrate compliance by other means under Article 53(4) and 55(2). The Commission’s Q&A on the final Code says non-signatories “may face increased information requests” and that signatories get “a streamlined compliance process, with enforcement focused on monitoring their adherence to the Code”. That is the whole bargain: legal certainty and a lighter evidential burden in exchange for signing commitments that in places exceed the bare text of the Act.

Signatories have since formed a Signatory Taskforce, chaired by the AI Office, which met for the first time on 30 January 2026 and again on 13 March, 27 March and 17 July 2026. Its published remit is to exchange implementation experience, discuss technical developments relevant to the commitments, and feed into AI Office guidance. The Q&A says the AI Office may formally update the Code at least every two years.

Enforcement since August 2026, and what has actually happened

Chapter IX section 5, Articles 88 to 94, gives the Commission exclusive competence to supervise and enforce Chapter V, exercised through the AI Office. The powers are graduated.

Under Article 89 the AI Office monitors compliance, including adherence to approved codes, and downstream providers may lodge complaints alleging infringement by a model provider. Under Article 91 the Commission may request the documentation drawn up under Articles 53 and 55 “or any additional information that is necessary for the purpose of assessing compliance”, after an optional structured dialogue, with a deadline and a reminder of the fines for “incorrect, incomplete or misleading information”. Under Article 92 it may conduct evaluations, request access to the model “through APIs or further appropriate technical means and tools, including source code”, and appoint independent experts including from the scientific panel. Under Article 93 it may require a provider to comply, to implement mitigation measures, to restrict the making available of a model, or to withdraw or recall it; commitments a provider offers during the dialogue can be made binding by decision.

Article 101 sets the fines: up to 3% of worldwide annual turnover in the preceding financial year or EUR 15 million, whichever is higher, for intentional or negligent infringement of Chapter V, for failing to comply with a request for documents or information or supplying incorrect, incomplete or misleading information, for failing to comply with an Article 93 measure, or for failing to give access for an evaluation. Before fining, the Commission must communicate preliminary findings and give the provider a hearing; the Court of Justice has unlimited jurisdiction to review a fine. The AI Act Service Desk describes “technical compliance dialogues” as the AI Office’s “first tool of choice”, with the formal powers reserved for cases where dialogue is not sufficient.

The record so far

Here is what is public as of 27 September 2026, and only that.

On 31 July 2026 the Commission announced that enforcement would begin on 2 August. The release confirmed that the AI Office is supported by a Scientific Panel of 60 independent experts that had just held its first meeting, that Professor Alessandro Abate of Oxford had been appointed Lead Scientific Adviser for model testing and evaluation, and that the AI Office had launched a Complaint Tool, a Whistleblower Tool and a dedicated channel for downstream providers to report alleged infringements by model providers. Executive Vice-President Henna Virkkunen’s quote in the release framed the stakes: “the most advanced models create risks on an entirely new scale”.

On 1 September 2026 the Commission confirmed at its midday briefing that the AI Office had sent its first formal requests for information to more than 30 providers of general-purpose AI models, in two strands: one on safety and security for the most advanced models, covering model security, independent external evaluation and post-market monitoring, and one on copyright and transparency, including training-content summaries. The Commission did not name the recipients. Press reports listed OpenAI, Anthropic and Google among them; the companies have not published the letters.

That is the entire public enforcement record. No fine has been imposed under Article 101. No Article 93 measure, no model restriction or withdrawal, and no Article 52 designation decision has been published. No list of systemic-risk models has appeared under Article 52(6). Anyone claiming otherwise is ahead of the facts. What has changed is that the requests are formal, the answers are fineable if misleading, and the AI Office now has a scientific panel and an evaluation mandate to test what it is told.

The Omnibus also moved one supervisory boundary that matters to builders. Under the amended Article 75 the AI Office has exclusive competence over AI systems built on a general-purpose model where the system provider and the model provider are the same undertaking, and over systems integrated into very large online platforms and search engines designated under the Digital Services Act. In plain terms, a lab’s own chatbot is supervised in Brussels; a third-party product built on that lab’s API is supervised by the national authority where the product’s provider is established.

What may still change

The Omnibus is law and its changes are settled, but three things remain open.

The thresholds. Article 51(3) lets the Commission amend the 10^25 FLOP presumption by delegated act and add benchmarks and indicators. The 10^23 FLOP criterion for general-purpose status and the one-third rule for modifiers live in guidelines, which the Commission can revise without legislation. Both are described as indicative and both were set in July 2025. As training efficiency improves, the compute thresholds capture more models for the same capability, so pressure to revise them upward will grow.

Harmonised standards. Articles 53(4) and 55(2) treat the Code as a bridge until harmonised standards are published. When European standards for model documentation, evaluation or incident reporting arrive, compliance with them will give a presumption of conformity and the Code’s centrality will fade. None had been published for Chapter V at the time of writing.

The Code itself. The Q&A anticipates formal updates at least every two years, which would put the first revision around mid-2027, informed by the Signatory Taskforce. The safety chapter’s list of systemic risks, the incident deadlines and the reporting templates are the parts most likely to move.

Figure 3: The model rules led the phase-in and the Digital Omnibus did not move them; the dates that shifted are the high-risk system dates at the end.

What this means for builders, in three situations

You call a hosted model through an API

Chapter V does not apply to you. You are a deployer, or a provider of an AI system if you offer a product, and your direct obligations arrive through the system rules. Since 2 August 2026, Article 50(1) requires that people interacting with your system are told they are dealing with an AI unless that is obvious; Article 50(2) requires providers of systems that generate synthetic audio, image, video or text to mark outputs in a machine-readable format as artificially generated, with a grace period to 2 December 2026 for systems already on the market before 2 August 2026; Article 50(4) requires deployers to disclose deepfakes and AI-generated text published to inform the public. None of these depend on which model you use.

What Chapter V gives you is leverage. Article 53(1)(b) obliges your upstream provider to give you the Annex XII information you need to comply, and the Code’s transparency chapter commits signatories to answer within 14 days. Article 89(2) lets you complain to the AI Office if they do not. If you route through several providers, a gateway that logs which model served each request is the record that answers a regulator’s first question; our comparison of LLM gateways covers what such logging costs and where each product keeps it. Procurement in European enterprises now routinely asks whether a vendor’s upstream models come from Code signatories. Expect the question and have the answer written down.

You fine-tune an open-weight model

Compute is your status. Record the FLOP of every training run against the base model’s published compute. Below one third you are not a provider of a new model, and the base model’s provider carries the Article 53 duties. You still carry the Article 50 duties for whatever system you ship, and you inherit the base model’s licence terms, which are a separate matter from the Act.

Above one third, which in practice means a continued pre-training run, you become the provider of a new general-purpose model and owe Article 53 for the modification: a technical file describing what you changed and on what data, downstream information, a copyright policy covering the data you added, and a training-content summary in the Commission’s template covering your additions. If you are outside the EU, you need an authorised representative. If your release is genuinely open-source and unmonetised, the technical file and downstream information duties fall away, but the copyright policy and the summary do not.

You train your own model

You are a provider from the moment the model is offered in the Union, by any channel. Article 53 applies in full: Annex XI technical file, Annex XII downstream information, copyright policy with opt-out handling, and a training-content summary published at market placement and updated. If cumulative training compute will exceed 10^25 FLOP, notify the Commission within two weeks of knowing, and if you sign the Code, confirm a Safety and Security Framework within four weeks of that notification and at least two weeks before launch, then deliver a Model Report at launch. Decide early whether to sign: the Code trades a heavier set of commitments for a lighter evidential burden and, in the AI Office’s own words, a streamlined process. A provider that does not sign must assemble and defend “alternative adequate means” and should expect more information requests. Either way, the cost of this work belongs in the model’s budget; our piece on the real cost of an AI product covers where compliance sits in that ledger.

A compliance checklist

For a provider:

1. Determine status: training compute above 10^23 FLOP and a generative modality means general-purpose; cumulative compute above 10^25 FLOP means systemic risk.
2. Identify every channel by which the model reaches the Union, including integration into your own products.
3. If outside the EU and not exempt, appoint an authorised representative before placing on the market (Article 54).
4. Draw up the Annex XI technical file, including FLOP and energy figures, and keep it current.
5. Prepare the Annex XII information pack and a public contact point for downstream requests.
6. Write and implement a copyright policy that honours robots.txt and other machine-readable reservations and does not circumvent paywalls.
7. Publish the training-content summary on the Commission’s template, including the top 10% of crawled domains, at market placement; models on the market before 2 August 2025 must have one by 2 August 2027.
8. Above 10^25 FLOP: notify within two weeks, evaluate with adversarial testing, assess and mitigate systemic risks, set up incident reporting against the Code’s two-, five-, ten- and fifteen-day deadlines, and secure the weights.
9. Decide whether to sign the Code and, if not, document your alternative means.
10. Prepare for an Article 91 request: know who answers, on what deadline, and that misleading answers are fineable.

For a deployer or system provider:

1. Keep a record of which model, from which provider, served each product and request.
2. Obtain and file the upstream provider’s Annex XII documentation and its training-content summary.
3. Implement Article 50 disclosures and machine-readable marking; the marking grace period ends 2 December 2026.
4. Log fine-tuning compute for every adapted model against the base model’s published figure.
5. Know your supervisor: the AI Office if your system comes from the same undertaking as the model or sits inside a designated very large platform, otherwise your national authority.

The judgement

A year of application and two months of enforcement have settled the question the 2024 debate could not: the general-purpose model rules are neither the innovation-ending burden their critics forecast nor the toothless gesture their sceptics expected. For the overwhelming majority of builders, the obligations are indirect and the practical work is record-keeping. For the dozen or so companies training above 10^25 FLOP, the obligations are real, most of them chose to accept a Code that goes beyond the statute, and the AI Office has now asked them, formally and on the record, to prove it.

The thing to watch is not the first fine. It is the first Article 92 evaluation, because that is the point at which the Commission stops taking a lab’s Model Report on trust and tests it. Until then, the honest description of the regime is a supervisor with strong powers, a good deal of goodwill on both sides, and a training-content transparency obligation that a surprising number of providers have still not met.