Application of the second set of provisions of the EU AI Act has started

Regulation (EU) 2024/1689 laying down harmonized rules on artificial intelligence (EU AI Act) entered into force in August 2024. Still, its full application should generally start on 2 August 2026, while the application of certain groups of provisions is phased in gradually. The first group of provisions of the EU AI Act, prohibiting certain AI practices, started to apply on February 2, 2025. The provisions of the second group begin to apply on August 2, 2025, and they regulate the following areas:

Governance at the Union level

The application of Chapter VII provisions of the AI ​​Act should mark the beginning of the work of the following bodies for governance and enforcement of this Regulation at the Union level.

  • The AI ​​Office, which was already established by the decision of European Commission (“Commission”), aims to develop Union expertise and capabilities in the field of AI, as well as to contribute to the implementation of Union law in the area of ​​AI (Article 64).
  • The European AI Board (the ‘Board’), which should reflect different interests in the implementation of this Regulation, and therefore shall be composed of one representative per Member State. The Board is responsible for a number of advisory tasks, including issuing opinions, recommendations, advice or contributing to guidance on enforcement matters, technical specifications or existing standards regarding the requirements established in this Regulation (articles 65 and 66).
  • A scientific panel of independent experts (the ‘scientific panel’), which is established by means of an implementing act of the Commission, and has the task of advising and supporting the AI ​​Office, in particular concerning the implementation and enforcement of rules on GPAI models and systems (articles 68 and 69).
  • An advisory forum, with the task to provide technical expertise and advise the Board and the Commission, and to contribute to their tasks under this Regulation.
  • The membership of the advisory forum should represent a balanced selection of stakeholders, including industry, start-ups, SMEs, civil society and academia (Article 67).

National competent authorities, notifying authorities

Each Member State is obliged to establish or designate as national competent authorities at least one notifying authority and at least one market surveillance authority for the purposes of this Regulation, as well as to communicate to the Commission the identity and the tasks of those authorities. In addition, they have to make publicly available information on how competent authorities and single points of contact can be contacted, through electronic communication means by 2 August 2025 (Chapter III, Section 4 and Article 70).ž

General-purpose AI models

As of August 2, the provisions that impose obligations on providers of general-purpose AI (GPAI) models (Chapter V of the AI ​​Act) also apply. Exempted are providers of GPAI models that have been placed on the market before this date, to which a grace period of two years (by 2 August 2027) applies.  

This Regulation defines a GPAI model as an AI model, including where such an AI model is trained with a large amount of data using self-supervision at scale, that displays significant generality and is capable of competently performing a wide range of distinct tasks regardless of the way the model is placed on the market and that can be integrated into a variety of downstream systems or applications, except AI models that are used for research, development or prototyping activities before they are placed on the market (Article 3(63)). 

A GPAI model shall be classified as a GPAI model with systemic risk if it meets any of the following conditions:

  • (a) it has high impact capabilities evaluated on the basis of appropriate technical tools and methodologies, including indicators and benchmarks (it is presumed to have high impact capabilities when the cumulative amount of computation used for its training measured in floating point operations is greater than 1025);
  • (b) based on a decision of the Commission, ex officio or following a qualified alert from the scientific panel, it has capabilities or an impact equivalent to those set out in point (a) having regard to the criteria set out in Annex XIII (Article 51).
  • Providers of GPAI models that meet these conditions must notify the AI Office without delay P (Article 52).       

The provisions of Chapter V impose obligations on providers of all GPAI models:

  • (a) to draw up and keep up-to-date the technical documentation of the model, including its training and testing process and the results of its evaluation, for the purpose of providing it, upon request, to the AI Office and the national competent authorities;
  • (b) to draw up, keep up-to-date and make available information and documentation to providers of AI systems who intend to integrate the general-purpose AI model into their AI systems;
  • (c) to put in place a policy to comply with Union law on copyright and related rights, and in particular to identify and comply with, including through state-of-the-art technologies, a reservation of rights expressed pursuant to Article 4(3) of Directive (EU) 2019/790;
  • (d) to draw up and make publicly available a sufficiently detailed summary about the content used for training of the general-purpose AI model, according to a template provided by the AI Office (Article 53).
  • Exception 1: the obligations set out in points (a) and (b) do not apply to providers of AI models that are released under a free and open-source licence that allows for the access, usage, modification, and distribution of the model, and whose parameters, including the weights, the information on the model architecture, and the information on model usage, are made publicly available. This exception do not apply to GPAI models with systemic risks.

In addition, providers of GPAI models with systemic risk are obliged:

  • (a) to perform model evaluation in accordance with standardised protocols and tools reflecting the state of the art, including conducting and documenting adversarial testing of the model with a view to identifying and mitigating systemic risks;
  • (b) to assess and mitigate possible systemic risks at Union level, including their sources, that may stem from the development, the placing on the market, or the use of GPAI models with systemic risk;
  • (c) keep track of, document, and report, without undue delay, to the AI Office and, as appropriate, to national competent authorities, relevant information about serious incidents and possible corrective measures to address them;
  • (d) ensure an adequate level of cybersecurity protection for the model and its physical infrastructure (Article 55).

Penalties

This set of provisions, whose application begins on August 2, 2025, also includes the provisions on penalties. In accordance with the terms and conditions laid down in this Regulation, Member States are obliged to lay down the rules on penalties and other enforcement measures, which may also include warnings and non-monetary measures, applicable to infringements of this Regulation by operators (providers, product manufacturers, deployers, authorised representatives, importers or distributors), as well as take all measures necessary to ensure that they are properly and effectively implemented. These penalties should be effective, proportionate, and dissuasive, and take into account the interests of SMEs, including start-ups, and their economic viability (Article 99).

  • Non-compliance with the prohibition of the AI practices (Article 5) should be subject to administrative fines of up to EUR 35 000 000 or, if the offender is an undertaking up to 7 % of its total worldwide annual turnover for the preceding financial year, whichever is higher;
  • Non-compliance with any of the following provisions related to operators or notified bodies should be subject to administrative fines of up to EUR 15 000 000 or, if the offender is an undertaking up to 3 % of its total worldwide annual turnover for the preceding financial year, whichever is higher:
    • obligations of providers of high-risk AI systems pursuant to Article 16 and their authorised representatives pursuant to Article 22;
    • obligations of importers, distributors and deployers of high-risk AI systems pursuant to articles 23, 24 and 26);
    • requirements and obligations of notified bodies pursuant to Article 31, Article 33(1), (3) and (4) or Article 34;
    • transparency obligations for providers and deployers pursuant to Article 50.  
  • The supply of incorrect, incomplete or misleading information to notified bodies or national competent authorities in reply to a request should be subject to administrative fines of up to EUR 7 500 000 or, if the offender is an undertaking up to 1 % of its total worldwide annual turnover for the preceding financial year, whichever is higher.

Although these penalty provisions became applicable, at the same time the application of the corresponding provisions, regulating the obligations of operators of high-risk AI systems, as well as transparency obligations for providers and deployers of certain AI systems, did not begin. Therefore, in the meantime, the penalty provisions only impose an obligation on the member states to prescribe penalties in the respective laws. Also, they can have a preventive, warning effect.

Conversely, although the provisions on the obligations of GPAI model providers entered into application, the effect of the corresponding penalty provision was postponed until August 2, 2026 (articles 113 (b) and 101). Namely, based on Article 101 of the Regulation, the Commission may impose on providers of GPAI models fines not exceeding 3% of their annual total worldwide turnover in the preceding financial year or EUR 15,000,000, whichever is higher, when the Commission finds that the provider intentionally or negligently infringed the relevant provisions of this Regulation. However, as the corresponding provisions on the exclusive powers of the Commission to supervise and enforce Chapter V have not yet entered into application (articles 88 – 93), the effect of this penalty provision has also been postponed.