The European Commission published the final implementing acts for the AI Act’s general-purpose model obligations. The 12-month compliance window starts now. The headline obligation is what everyone expected: copyright policy, energy reporting, evaluation summaries. The binding constraint, quietly, is the training-data summary requirement.
Providers must publish a “sufficiently detailed summary” of training data. The Commission’s template defines “sufficient” more aggressively than the draft language suggested , source-level breakdown rather than aggregate categories. Frontier labs that have been deliberately vague about training composition will have to either disclose more than they want or accept the systemic-risk classification with its tighter requirements.
US providers serving EU users are in scope. Expect the next 90 days to be lawyer-led and the 90 days after that to be quiet product changes.