The European Commission published the final implementing acts for the AI Act’s general-purpose model obligations. Compliance clock starts now, 12 months on the meter. The headline obligations are the ones everyone expected and already drafted talking points for: copyright policy, energy reporting, evaluation summaries. Nothing-burgers, in PR terms.
The binding constraint, quietly nestled in the template the Commission published, is the training-data summary requirement. Providers have to publish a “sufficiently detailed summary” of training data, and “sufficient” came in noticeably more aggressive than the draft language hinted: source-level breakdown, not the vague aggregate categories the labs were hoping to get away with. Frontier labs that have spent two years saying “we trained on a diverse mixture of internet sources” with a straight face now have a choice. Disclose more than they want to, or accept the systemic-risk classification and the tighter requirements that come with it. Neither option is fun for the legal team.
US providers serving EU users are in scope. Standard extraterritorial energy. Expect the next 90 days to be lawyer-led press releases, and the 90 days after that to be quiet product changes nobody comments on.