The general-purpose AI provisions took effect on 2 August 2025, and the following August is the compliance milestone for models already on the market before that date1. Providers must have technical documentation, a training-data summary, and a copyright policy on file.

Models classed as systemic risk carry additional duties: adversarial evaluation, incident reporting to the AI Office, and cybersecurity measures25. The threshold is defined by training compute, with a presumption above 10²⁵ FLOP.

Penalties for GPAI breaches reach 3% of global turnover or €15M, whichever is higher3.