The EU AI Act's New Rules Just Hit Every Major AI Model Maker
New obligations for general-purpose AI providers took effect this month, and the rest of the world is still deciding how, or whether, to follow.
Brussels does not move fast, which is precisely why the date mattered when it finally arrived. On August 2, a new set of obligations under the European Union's AI Act came into force for providers of general-purpose AI models, the category that covers essentially every major large language model on the market, from GPT-5 to Claude to Gemini to the open Chinese models now competing with all of them.
What are the new general-purpose AI obligations
According to a client note from Baker McKenzie, companies placing general-purpose AI models on the EU market on or after August 2 must now maintain detailed technical documentation, publish a summary of the data used to train their models, and put copyright compliance policies in place covering how training data was sourced and used. The rules apply regardless of where the company developing the model is headquartered, so long as the model is offered to users inside the EU.
A separate analysis from DLA Piper describes this as the latest wave in a rolling implementation schedule the AI Act has followed since it formally entered into force last year, with different categories of obligations activating in stages rather than all at once. General-purpose AI providers are simply the latest category to come due.
What the EU's Code of Practice actually requires
Alongside the legal obligations, the European Commission and the newly formed EU AI Office released a General-Purpose AI Code of Practice, formally approved on August 1, one day before the rules took effect. Adhering to the Code is voluntary, but Skadden's analysis of the guidance notes that providers who sign on and follow its specific measures get a presumption of compliance with the underlying legal requirements, giving companies a clearer, lower-risk path than trying to interpret the statutory text from scratch.
Which companies have to comply and by when
The timeline has a wrinkle that matters for existing products. Models already on the EU market before August 2 are not required to be fully compliant immediately; providers of those models have until August 2, 2027 to bring them into line. Genuinely new models released after the deadline, though, have to meet the obligations from day one. And while the legal duty exists now, the European Commission is not expected to begin actively enforcing penalties against general-purpose AI providers until August 2026, giving the industry roughly a year to adjust before fines become a real prospect.
How AI labs outside Europe are reacting
The reaction from major labs has been muted publicly but active behind the scenes. Documentation and data-summary requirements sound modest compared to earlier fears that the AI Act would impose EU-wide restrictions on training itself, but for companies that have resisted disclosing training data sources for competitive reasons, even a summary-level disclosure requirement is a meaningful shift, and one that is being watched closely by regulators in other jurisdictions weighing similar rules. What makes the EU AI Act worth tracking outside the EU is precedent. Just as European data protection rules from the last decade ended up shaping privacy practices for companies that never set out to comply with EU law specifically, general-purpose AI obligations that force disclosure and documentation from the world's biggest model providers are likely to shape norms well beyond the borders that technically require them, if only because it is often simpler for a global company to build one compliance standard than several.
How the EU AI Act compares to US and China AI rules
The contrast with the regulatory approach taken elsewhere is stark. The United States has so far relied on a patchwork of executive orders, agency guidance and state-level rules rather than a single binding federal framework for general-purpose AI, leaving companies to navigate a shifting set of expectations that can change with each administration. China, meanwhile, regulates AI through a more direct system of content controls and algorithm registration requirements administered by its cyberspace regulator, prioritizing state oversight of outputs over the kind of training-data transparency the EU is now demanding.
That divergence means a company like OpenAI, Anthropic or Google now effectively operates under three different regulatory philosophies simultaneously depending on where its users are located. Some in the industry argue this fragmentation is exactly the outcome the EU wanted to avoid when it pitched the AI Act as a potential global standard, similar to how its data protection rules became a de facto template. Others counter that a documentation and transparency requirement is modest enough that most serious providers were already moving in that direction voluntarily, making the EU's rule less a radical intervention than a codification of where responsible practice was already heading.
What businesses using AI models should watch next
For companies that simply use these models rather than build them, the immediate practical impact is limited: the obligations fall on providers, not downstream users of an API. But the technical documentation these rules require, once published, should make it easier for businesses and researchers to compare models on data provenance and copyright handling rather than relying purely on marketing claims and benchmark charts, a small but meaningful shift in how the AI market's least transparent corner starts to look from the outside.
Published in The Outspoken Digest
Read Next
More Technology →
