On 2 August 2025, the EU AI Act entered its general-purpose AI and governance stage. Obligations for providers of general-purpose AI models became applicable, EU-level governance structures had to be established, and Member States were required to designate national competent authorities and adopt national penalty rules. This date therefore mattered both to GPAI providers and to the regulatory bodies responsible for supervising the Act.
Why Does 2 August 2025 Matter?
The August 2025 milestone was the second application stage of the AI Act, following the February 2025 stage for definitions, literacy and prohibitions. It added two distinct layers at once: substantive obligations for a new class of actor, the providers of general-purpose AI models, and the governance infrastructure needed to supervise the Act. That combination meant the date mattered to model providers, to downstream organisations building systems on third-party models, and to the authorities themselves. It also set the boundary for what came next: transparency and enforcement followed in August 2026, and the high-risk requirements followed later still, as amended by Regulation (EU) 2026/1744. An organisation that treated August 2025 as a general application date would have overstated its duties, while one that ignored it would have missed the model layer that increasingly underpins its systems.
Which GPAI Provider Obligations Became Applicable?
On 2 August 2025, the obligations in Chapter V for providers of general-purpose AI models became applicable. In outline, a provider must draw up and keep up to date technical documentation of the model, provide information and documentation to downstream providers who intend to integrate the model into their AI systems, put in place a policy to comply with Union copyright law, and draw up and make public a sufficiently detailed summary of the content used for training the model. Those duties are model-level duties: they concern the model, its documentation and its downstream information flow, rather than any single downstream system. A provider should have been able to show, from August 2025, the documentation, the downstream information, the copyright policy and the training summary, each dated and attributed, and should have kept them up to date as the model changed. A downstream provider should have recorded what it received and what was missing.
For the broader regulatory framework, see EU AI Act timeline.
What Additional Duties Apply to Systemic-Risk Models?
General-purpose AI models classified as presenting systemic risk face additional duties under Article 55, beyond the Article 53 duties that apply to all general-purpose AI model providers. In outline, those duties include performing model evaluations, assessing and mitigating systemic risks, tracking and reporting serious incidents, and ensuring an adequate level of cybersecurity protection. Classification as presenting systemic risk follows Article 51, on the basis of the model's capabilities, including where the cumulative amount of computation used for training exceeds the threshold in the Act, or where the Commission designates the model following an assessment, including on the basis of a qualified alert from the Scientific Panel. A provider whose model may present systemic risk should therefore have maintained evaluation and risk assessment evidence from August 2025, and should have been ready for the Commission's classification and supervision work, rather than treating systemic risk as a label that could be addressed later.
What EU-Level Governance Had to Be in Place?
By 2 August 2025, the EU-level governance structures for the Act had to be established: the AI Office within the Commission, the European Artificial Intelligence Board composed of Member State representatives, the Scientific Panel of independent experts, and the Advisory Forum of stakeholders. Each body has a distinct role: the AI Office supervises general-purpose AI models and supports implementation, the Board coordinates Member States and advises the Commission and Member States, the Panel provides independent expert support, particularly on systemic-risk models, and the Forum provides stakeholder expertise. The existence of those bodies from August 2025 meant that guidance, codes of practice, evaluations and coordination had institutional owners, and that a provider or authority with an implementation question had a forum to address. Their establishment did not itself impose a new duty on most operators, but it made the supervision and guidance system real, and organisations should have tracked the bodies' outputs from that date.
What Regulatory Work Did Member States Have to Complete?
Member States were required, by 2 August 2025, to designate their national competent authorities under Article 70, including at least one notifying authority and at least one market surveillance authority, with a single point of contact, and to lay down rules on penalties for infringements under Article 99. Designation and penalty rules are the national infrastructure on which market surveillance and enforcement depend, and their completion by August 2025 was a precondition for the enforcement stage that followed in August 2026. An organisation operating in a Member State should have identified, from that date, the designated authorities for that State, the single point of contact, and the national penalty framework, rather than assuming the structure of another State applied. National implementation varied by Member State, and the identity of the authorities and the content of the penalty rules must be confirmed from the Member State's official material, not from a general summary of the Act.
Continue with what changed on 2 February 2025.
What Did Not Start on 2 August 2025?
Article 50 transparency requirements did not start on 2 August 2025; they began applying on 2 August 2026, subject to the limited transition for certain pre-existing systems ending on 2 December 2026. Enforcement powers for key applicable provisions also began in August 2026, not August 2025, although the governance and penalty framework had to be in place a year earlier. The main high-risk requirements did not start in 2025 either: they apply from 2 December 2027 for Annex III systems and 2 August 2028 for Annex I systems, as amended by Regulation (EU) 2026/1744. Treating the August 2025 milestone as the general application date would therefore misstate both the transparency and the high-risk positions. The correct reading is narrower and more useful: August 2025 was the general-purpose AI and governance date, and the other stages kept their own dates.
What Should Organisations Have Recorded After This Date?
After 2 August 2025, an organisation should have recorded, for each model it supplied or used, the model and version, the model provider's identity, the model's general-purpose AI status, any systemic-risk classification or assessment, the provider documentation received, the downstream dependencies, and the review and update triggers for the model. A model provider should have recorded its own documentation, downstream information, copyright policy, training summary and, where relevant, systemic-risk evaluation and mitigation work. A downstream organisation should have recorded how the model was integrated, what information survived downstream processing, and how the downstream system was classified on its own intended purpose. Those records, kept together by model and version, are what allow a later reviewer to see whether the August 2025 duties were met, and they form the basis for the transparency, high-risk and enforcement work that followed in 2026 and 2027.
Frequently asked questions
Did GPAI obligations start applying on 2 August 2025?
Yes. The AI Act's obligations for providers of general-purpose AI models became applicable on 2 August 2025, including technical documentation, downstream information, a copyright policy and a public training summary, with additional duties for models presenting systemic risk.
Did AI Act enforcement fully start on 2 August 2025?
No. The 2025 date was an important GPAI and governance application milestone, with national authorities designated and penalty rules required. Key enforcement powers began applying from 2 August 2026 for provisions already in application.
Why does the 2 August 2025 date matter to companies using third-party models?
A downstream company may not be the GPAI provider, but model-level documentation, provider information and supply-chain relationships can affect how it assesses and documents the AI systems it builds or deploys. The downstream system has its own classification and duties, which depend in part on what the model provider supplied.
What does this article not decide?
This article does not decide whether any particular model is a general-purpose AI model or presents systemic risk, and it does not determine what a specific provider or downstream organisation must do. Those questions turn on the model's capabilities, the provision and the facts, and should be confirmed with a competent authority or legal adviser where they are contested.
Continue through this AI Act cluster
This article is an informational overview, not a legal determination. Check the current legal text and official implementation guidance for your system and role.
Consolidated Regulation (EU) 2024/1689, as amended ↗AI Act Service Desk implementation timeline ↗European Commission AI Act overview ↗