Obligations for providers of general-purpose AI models under the EU AI Act, including systemic-risk duties to evaluate models, mitigate risks, report serious incidents and ensure cybersecurity, entered into application on August 2, 2025. The Commission's enforcement powers apply from August 2, 2026, and models placed on the market before August 2025 must comply by August 2, 2027.
Why it matters
It is a binding regime under which frontier model cyber-offence risk must be assessed and serious incidents reported.
Key facts
As stated in the sources, with where to find them.
- GPAI provider obligations entered into application on August 2, 2025; Commission enforcement powers from August 2, 2026; legacy models must comply by August 2, 2027.Guidelines page, timeline
Findings that cite this record
No tracked finding cites this record yet.
Sources
Related records
Jul 10, 2025
Sep 29, 2025
Jul 23, 2025
Sep 23, 2026
Jul 7, 2026
Jul 2, 2026