Article content
In briefShow moreShow lessRules for general-purpose AI models started applying in the EU on 2 August 2025.
- Rules for general-purpose AI models started applying in the EU on 2 August 2025.
- Transitional rules distinguish new models from models already on the market.
- Applied in the EU from this date. Norway had not yet enacted its KI law; Norwegian providers could still be in territorial scope when placing models or outputs in the EU market.
What happened
Rules for general-purpose AI models started applying in the EU on 2 August 2025. Duties included technical documentation, information for downstream actors, a copyright policy, and dedicated risk management for models with systemic risk.
Transitional rules distinguish new models from models already on the market. Organisations therefore needed to record version, market date and provider role, not only the model name.
Legal status in Norway
Applied in the EU from this date. Norway had not yet enacted its KI law; Norwegian providers could still be in territorial scope when placing models or outputs in the EU market.
What the sources clarify
Transition rules made release date and model version material. New models placed on the market after the duties began to apply had to comply from the outset, while existing models had a later deadline. Downstream providers needed information about capabilities and limitations to document their own systems. Models with systemic risk faced added requirements for evaluation, risk mitigation, serious-incident reporting and cybersecurity. Contracts should therefore cover version notices, technical documentation, copyright policy, incident contacts and what happens if a model is later classified as posing systemic risk.
Downstream providers should manage model updates as controlled changes. Before adopting a new version, they need to know whether capabilities, limitations, training summary or systemic-risk status changed. The contract should allow time for testing and permit an upgrade to be held back when documentation or security information is missing.
Practical implications
Before approving a model update, the system owner should document regression tests, changed limitations and whether downstream records remain accurate. If the provider cannot give sufficient notice of material changes, the contract should let the customer remain on a supported version or change models.
Sources
European Commission: “General-purpose AI obligations under the AI Act,” 2 August 2025.
EUR-Lex: “Regulation (EU) 2024/1689 — Official Journal text,” 12 July 2024.
For discussion
Which supplier do we need more evidence from?
