If you provide a foundation model to the EU market, the most useful fact about the AI Act in 2026 is that the much-reported delay was not about you. The EU AI Act's general-purpose AI obligations have applied since 2 August 2025, and the Commission's own AI Act page describes the 2026 omnibus as changing other dates, not these.[4] This guide reads the Commission's published material to set out who is covered, what providers must do, which dates matter and where the text stops short. It is a reading of guidance pages, not legal advice, and the statute itself should be checked with counsel.
Who is covered
The obligations fall on providers of general-purpose AI models, which in our reading means the organisation that develops the model and places it on the EU market rather than everyone who builds a product on top of one. The Commission's guidelines page says they offer "straightforward technical criteria" for when a model counts as general-purpose.[1] The FAQ gives the indicator: a model trained with compute exceeding 10^23 floating point operations that can generate language, text-to-image or text-to-video output. The Commission adds that this "is not an absolute rule", so exceptions run in both directions.[2]
For downstream teams, the FAQ addresses fine-tuning directly. A modifier becomes a provider only in exceptional cases, when the modification uses more than one-third of the original model's training compute. Otherwise a significant modification needs documentation only of the changes and the new training data.[2] If you fine-tune an open-weight model on a modest budget, that threshold is the sentence to read closely. Our own reading is that most application-level fine-tuning is therefore unlikely to make you a provider, but the Commission does not say that in those words, and you should confirm with counsel.
What providers must do
The FAQ lists three duties for all providers of general-purpose models:[2]
- Technical documentation. Providers must "draw up and maintain technical documentation about the model", available to the AI Office on request.
- Copyright policy. They must "implement a policy to comply with Union copyright law and related rights."
- Training-content summary. They must "publish a sufficiently detailed summary of the content used for training the model."
For the third, the Commission published an explanatory notice and template on 24 July 2025, last updated 26 March 2026, which it describes as a "common minimal baseline for the information to be made publicly available".[5] The template page we retrieved does not list the required sections, so read the linked template itself before drafting.
Systemic-risk models
A model is presumed to have high-impact capabilities when trained with "a cumulative amount of computational resources exceeding 10^25 FLOP." Providers meeting that threshold must notify the Commission, and may argue that their model does not present systemic risk.[2] The Code of Practice's Safety and Security chapter applies only to providers of the most advanced models with systemic risk.[3]
The open-source carve-out is narrow
Models released under "a truly free and open-source license" get relief from some documentation duties. Those providers are still required to meet the copyright policy obligation and publish a training data summary, and the Commission states the exemption does not apply to models with systemic risk.[2] For why licence wording matters, see open weights vs open source.
The dates that matter
| Date | What the Commission's pages say |
|---|---|
| 2 August 2025 | General-purpose AI obligations apply[1][4] |
| 2 August 2026 | The Commission will enforce compliance with provider obligations, including with fines[1] |
| 2 August 2027 | Deadline for models placed on the market before 2 August 2025[1] |
| 2 December 2027 | High-risk rules for Annex III use cases (extended)[4] |
| 2 August 2028 | High-risk rules for AI embedded in regulated products (Annex I)[4] |
During the first year, the FAQ says the AI Office "will not consider them to have broken their commitments under the Code" if Code adherents do not immediately implement every commitment.[2] The FAQ ties that grace period to the first year, so check the current text for how it applies now.
What the omnibus changed
The Commission's AI Act page says the AI omnibus was described as adopted on 19 November 2025, politically agreed on 7 May 2026 and in force from 27 July 2026. It lists the high-risk extensions above, a new prohibition on systems generating non-consensual sexual content or child sexual abuse material from December 2026, stronger AI Office powers, simplifications for small and mid-cap companies, and sandboxes. None of the listed changes touches general-purpose AI timing.[4] The page's last update was 3 August 2026.
One caution on our side: we confirmed this from the Commission's summary page. We could not open the Official Journal text of the omnibus in this session, so the exact legal wording of the AI Office provisions is unverified here.
The Code of Practice
The Commission published the General-Purpose AI Code of Practice on 10 July 2025. It is a voluntary tool prepared by independent experts, which the Commission and the AI Board confirmed is "an adequate voluntary tool for providers of GPAI models to demonstrate compliance with the AI Act." It has three chapters: Transparency (with a Model Documentation Form), Copyright, and Safety and Security.[3]
The Commission's page lists signatories including Amazon, Anthropic, Google, IBM, Microsoft, Mistral AI and OpenAI. It says xAI signed only the Safety and Security chapter, so it must show compliance with the transparency and copyright obligations by other adequate means.[3] The FAQ confirms the alternative route: providers can demonstrate compliance through an adequate Code or by other adequate means.[2]
The practical trade-off, in our reading: signing buys a recognised route to showing compliance, while a bespoke route keeps flexibility but puts the burden of proving adequacy on you. The Commission's page says signing offers more legal certainty than other methods.[3]
What the guidance does not settle
- The guidelines are not law. The Commission states they are "not legally binding" and reflect its interpretation, and that only the Court of Justice can give an authoritative interpretation.[1][2]
- Thresholds are indicators. The 10^23 figure is explicitly not absolute; the 10^25 figure is a presumption a provider can contest.[2]
- Deployer obligations are a different regime. Everything here concerns model providers. Obligations for systems built on top, including the high-risk rules, follow other timelines.
A short checklist for a model provider
- Decide whether your model plausibly exceeds the indicative compute marker and offers general capabilities.
- Have a documentation file, a copyright policy and a training-content summary in place for models placed on the market since 2 August 2025, and by 2 August 2027 for older ones.[2]
- Estimate cumulative training compute against 10^25 FLOP and decide whether you must notify.
- Choose your route: the Code of Practice or alternative adequate means, and write down why.
- Re-check the Commission page before every release, because dates and guidance have already changed once this year.[4]
For the risk-management side that many buyers will ask about next, see our guide to the NIST AI Risk Management Framework, and for the technical documentation habits that help, see how to read an AI benchmark claim.
