EU AI Act, phase two: rules for the model makers
The latest obligations fall mainly on companies that build large AI models. For businesses that use them, they bring more transparency — and a few things to check.
By the Xuru Technologies team · 3 August 2025
Key takeaways
- From 2 August 2025, providers of general-purpose AI (GPAI) models placed on the EU market must meet transparency, documentation and copyright-related obligations.
- Models with systemic risk face additional duties such as evaluations and incident reporting.
- The Commission published guidelines and a template for summarising training data; a voluntary code of practice supports compliance.
- Businesses using these models benefit from better documentation and should still meet their own obligations.
If your business uses AI built by OpenAI, Anthropic, Google, Meta or Mistral, the makers of those models now have specific EU obligations.
What happened
Mayer Brown and Baker McKenzie summarised the obligations and the supporting guidance. Enforcement powers relating to GPAI providers follow from August 2026.
What it means for businesses using AI
- More information from providers about capabilities, limitations and training data.
- Your own duties remain: AI literacy, transparency to users and data protection.
- Choose providers carefully. Check whether they commit to the EU code of practice.
- Building on top of models? Significant modification can create provider obligations for you too.
What to check
| Question | Where to look |
|---|---|
| Does our AI provider document its models? | Provider's model cards and policies |
| Is our use transparent to customers? | Website chatbot labels and notices |
| Have staff had AI training? | Your AI literacy records |
| Are we fine-tuning or modifying models? | Discuss obligations with your adviser |
Frequently asked questions
Does a small business using ChatGPT have new obligations from August 2025?
The GPAI obligations fall on model providers. Users still have duties such as AI literacy and, for some uses, transparency. This is not legal advice.
What is the GPAI code of practice?
A voluntary code developed with industry and experts that helps GPAI providers show how they meet AI Act obligations.
When do high-risk AI rules apply?
Most high-risk obligations were scheduled for August 2026 and 2027, subject to any later changes.
AI that's clear about what it is.
We build transparent, well-documented AI assistants and workflows for businesses serving EU customers.
Websites, payments, digital marketing, AI automation, consultancy and practical technology training — for businesses and aspiring professionals worldwide.
Saturday – Sunday: closed
Leave a Reply