Starting from 2 August 2025, the AI Act rules applicable to general-purpose AI models will begin to apply. To reduce the administrative burden on providers and support adherence to the new rules, the European Commission’s AI Office published the final version of its General-Purpose AI Code of Practice on 10 July 2025. While not mandatory, the Code of Practice outlines the commitments expected of general-purpose AI models and therefore represents a key compliance driver.

Which AI Act rules come into effect on 2 August 2025?

General-purpose AI models (GPAI)

• Draw up technical documentation outlining the main characteristics of the model and make it available upon request to authorities and downstream providers. Open-source GPAIMs are exempt (unless they qualify as GPAIMs-SR).
• Implement a copyright policy outlining how the provider complies with EU copyright law and opt-outs expressed by rightsholders.
• Publish a sufficiently detailed summary of the content used for training the model.
• Appoint an EU representative for providers from third countries.

General-purpose AI models with systemic risk (GPAI-SR)

• Notify the European Commission if the GPAI poses systemic risk (presumed for GPAI exceeding 1025 floating point operations).
• Perform a model evaluation, including conducting and documenting adversarial testing of the model with a view of identifying and mitigating systemic risks.
• Assess and mitigate possible systemic risks.
• Report serious incidents to the AI Office and, as appropriate, to competent national authorities.
• Ensure an adequate level of cybersecurity protection. 

Ensure an adequate level of cybersecurity protection.

AI Act Governance

By 2 August 2025, member states must designate “national competent authorities” —a crucial step in each jurisdiction that the private sector highly anticipates. In summary, the following governance rules start to apply as a key milestone for member states introducing implementing legislation:

• Designation of national competent authorities responsible for enforcing the AI Act
• Rules on penalties, except for GPAI penalties imposed directly by the European Commission
• Designation of notifying authorities and notified bodies responsible for conformity assessments of high-risk AI
• Establishment of the AI Office, AI Board, Advisory forum and scientific panel
• Confidentiality obligations when carrying out tasks under the AI Act

How does the milestone affect AI models which are already placed on the market?

The rules only apply to GPAI models placed on the market after 2 August 2025. Models first made available on the EU market before that date are subject to an extended deadline until 2 August 2027.

What are the practical implications for EU businesses?

• Providers of GPAI/ GPAI-SR will have to comply with new rules when placing new GPAI models on the EU market after 2 August 2025. Providers do not have to worry (yet) about models placed on the market before that date.
• Downstream providers relying on GPAI can expect more details about the models once providers start making available technical documentation.
• Copyright holders can expect more transparency about how providers use copyright-protected content and how providers comply with copyright laws.
• Businesses and users can expect increased transparency and safety of GPAI placed on the EU market after 2 August 2025.

How does the General-Purpose AI Code of Practice complement the new rules?

The Code of Practice details how GPAI providers should comply with their AI Act obligations. Based on intensive stakeholder debate that preceded its issuance, the Code of Practice formulates practical commitments on safety, transparency, and copyright. The published final version is currently pending official approval by the European AI Office and AI Board, expected before the 2 August deadline.

The Code consists of three parts: Transparency and Copyright-relevant for all GPAI providers-and Safety and Security, relevant only for providers of GPAI models with systemic risk.

1. The Transparency chapter includes a Model Documentation Form to be used as a template for the technical documentation made available to authorities and downstream providers.
2. The Copyright chapter elaborates on the AI Act's requirement for a copyright policy. The proposed commitments support the lawful use of data during the development phase, compliance with opt outs from text and data mining, mitigating the risk of copyright-infringing outputs, and enabling rightsholder complaints.
3. The Safety and Security chapter lays down procedures for managing systemic risks of GPAI. These measures include putting in place and updating a safety and security framework, identifying, assessing and mitigating systemic risks, as well as reporting serious incidents.

Is accepting the Code of Practice mandatory for all providers?

Signing up to the Code of Practice is not mandatory but serves as a practical way of demonstrating compliance with the AI Act. Providers that choose not to commit must adopt alternative methods that are equally adequate, effective, and proportionate. Either way, the Code of Practice will likely play a crucial role in the interpretation of AI Act obligations and in setting standards for compliance—which could inevitably affect even those providers who choose not to adhere.

What other guidance can GPAI providers expect?

Following a consultation procedure concluded in May 2025, the AI Office is currently preparing guidelines on key concepts related to GPAI Models. To complement the Code of Practice, the AI Office is also developing a template for disclosing a sufficiently detailed summary of the content used for training GPAI models as required by the AI Act.

Guidelines on the scope of obligations for providers of GPAIs

In addition to the Code of Practice, on 18 July 2025, the European Commission issued comprehensive Guidelines on the scope of obligations for general-purpose AI models under the EU AI Act. These guidelines provide interpretation of key concepts and requirements that will be enforced by the AI Office.

Notable Clarifications from the Guidelines

When is a model a GPAI? The guidelines reiterate that models must exceed the training compute threshold of 10²³ FLOP, while also displaying the capability of performing a wide range of tasks to constitute GPAIs. They also include examples of hypothetical models that would be in- and out of scope of the regulation.

When is an actor a provider placing on the market a GPAI? The guidelines clarify when an actor qualifies as a provider of a GPAI model and what constitutes their placing on the market. They include examples of providers, examples of placing on the market, and considerations for GPAIs integrated into AI systems. The section also addresses downstream modifiers, outlining when they become providers.

Open-source models? The guidelines specify when are GPAI considered as open-source and clarify the exemptions from certain GPAI obligations for models released as open-source.
How should training compute be estimated? The guidelines provide detailed methodologies for calculating training compute, including hardware-based and architecture-based approaches, as well as specific examples for models with approximately one billion parameters.

Further guidance. The guidelines also include details on the enforcement of the obligations of providers, talking specifically about the effects of adhering to an adequate code of practice

Dentons resources

• AI & GDPR Updates
• Dentons Newsletter AI Act (Czech)
• Dentons Global AI trends report: key legal issues for 2025
• Visit our Dentons AI: Global Solutions Hub
• LinkedIn profile: Dentons Česká republika