More than 40 of the most powerful CEOs of European technology companies asked the European Commission to delay the AI Act deadlines. The Commission responded unequivocally: “no stop the clock, no grace period, no pause.” If your company uses AI models by building products on them, integrating APIs or deploying chatbots, the deadlines are running. Duties for general-purpose AI (GPAI) model providers have applied since 2 August 2025. Full application of the rules for high-risk AI systems begins on 2 August 2026.
This article explains what that means for your technology company. It sets out how AI Act duties depend on your role, what the GPAI Code of Practice is, why Meta’s refusal matters to purchasing decisions and what to do over the coming months.
Key terms you need to know
Before getting into the details, it helps to clarify the terminology. The AI Act introduces concepts that directly determine the scope of your obligations.
| Term | Meaning | Why it matters to you |
|---|---|---|
| GPAI model (general-purpose AI model) | A model capable of performing a wide range of tasks and capable of being integrated into various systems, such as GPT-4, Claude, Llama or Mistral. It is one type of AI system. | If you build a product on such a model, you have deployer duties. If you create the model, you have provider duties. |
| GPAI provider | An entity that develops a GPAI model and places it on the market under its own name. | The full set of Chapter V AI Act duties, including documentation, copyright and safety. |
| Deployer | An entity using an AI system under its own control in its professional activity. | Duties under Chapters III and IV of the AI Act, including human oversight, transparency and AI literacy. |
| Systemic risk | A GPAI model whose training compute exceeds 10^25 FLOPs, or which the Commission considers capable of having a high impact. | Additional duties, including safety testing, incident reporting and cybersecurity. |
| GPAI Code of Practice | A voluntary code approved by the Commission that gives a presumption of conformity with the AI Act. | Signing makes it easier to demonstrate compliance. Without signing, conformity must be demonstrated by other means. |
| AI literacy | The duty to ensure that employees understand AI systems’ capabilities, limitations and risks. | It has applied since 2 February 2025 and covers every company using AI. |
The Commission refused to suspend the AI Act. What does that change?
The EU AI Champions initiative brought together about 50 CEOs of Europe’s largest technology companies. They argued that the rules were unclear, technical standards were missing and the timetable was too ambitious. The Commission did not accept those demands. Commission spokesperson Thomas Regner confirmed that there would be no postponement, grace period or pause.
For companies that built their compliance strategy on the assumption that “there will be a delay anyway,” there is now very little time to catch up.
The timetable already in force or approaching is:
| Date | Obligation | Status |
|---|---|---|
| 2 February 2025 | Prohibited AI practices and AI literacy | In force |
| 2 August 2025 | Duties for GPAI providers, including documentation, copyright and a summary of training data | In force |
| 2 August 2026 | The Commission’s full enforcement powers for GPAI duties, including imposing fines; full application of rules for high-risk AI systems | In one year |
| 2 August 2027 | Adaptation deadline for GPAI models placed on the market before 2 August 2025 | In two years |
| 2 December 2027 | Rules for high-risk systems in biometrics, infrastructure, education and employment | In two and a half years |
The Commission’s only compromise is the so-called Digital Omnibus: a delay until December 2027 for high-risk systems. GPAI duties have not been delayed.
The GPAI Code of Practice: what it contains and why it matters
The GPAI Code of Practice was published on 10 July 2025, less than a month before the duties took effect. It is voluntary, but signatories benefit in practice from a presumption of conformity with the AI Act. Signing therefore simplifies demonstrating compliance to the Commission and AI Office. OpenAI, Anthropic, Mistral and Microsoft announced that they would sign. Meta refused, accusing the EU of excessive regulation.
The Code has three chapters
Chapter 1: transparency and documentation (all GPAI providers)
- Prepare complete model documentation when the model is made available on the market.
- Update the documentation after every material model change.
- Keep documentation for at least 10 years after placing the model on the market.
- Respond to a request from a supervisory authority or downstream user within 14 calendar days.
- Documentation covers architecture, parameter count, training techniques, types of training data, evaluation results and estimated energy consumption.
Chapter 2: copyright (all GPAI providers, including open source)
- Adopt and maintain a documented copyright policy.
- Identify and respect machine-readable rights reservations, such as robots.txt files and HTTP headers.
- Reduce the risk of generating copyright-infringing outputs.
- Establish a contact point and complaint mechanism for rights holders.
- Document training-data sources and publish a summary of training content.
Chapter 3: safety and security (only models with systemic risk)
- Establish a Safety and Security Framework covering the model’s entire lifecycle.
- Conduct internal and external red-team testing.
- Put safeguards in place against prompt injection, jailbreaks and malicious-data injection.
- Document environmental impact, including energy use and CO₂ emissions.
- Archive successive model versions for incident analysis.
Mapping the Code to the AI Act
| Code chapter | Corresponding AI Act provision | Who it covers |
|---|---|---|
| Chapter 1: transparency | Article 53(1)(a) and (b) | All GPAI providers |
| Chapter 2: copyright | Article 53(1)(c) and (d) | All GPAI providers, including open source |
| Chapter 3: safety | Article 55 | Providers of models with systemic risk |
Provider, deployer, integrator: determine your role
This is the most important decision because it determines the full scope of your duties. The AI Act distinguishes roles in the AI value chain and assigns different obligations to each.
If you use a GPAI model API, such as OpenAI or Anthropic, to build your own application, you are a deployer. GPAI duties rest with the model provider, not you. Your duties as a deployer include human oversight, transparency toward users and AI literacy for your team.
If you integrate an API into a system you sell to customers, such as an HR system with an AI module, you are an AI-system provider. If the system is high-risk, you have the full set of Chapter III AI Act duties. GPAI duties still rest with the provider of the base model. See the discussion of who bears responsibility for AI Act compliance.
If you substantially modify an existing model and make it available under your own brand, you may become a GPAI provider. The threshold is training compute used for the modification exceeding one third of the compute used for the original model. Minor fine-tuning for your own use does not, as a rule, change your role.
Watch for role changes
A company that places its own logo on an AI system, substantially modifies its operation or changes its intended purpose ceases to be merely a deployer and is treated as a provider. This means a much broader set of duties. Many startups may cross this line without realizing it.
| Scenario | Your role | GPAI duties | Deployer or AI-system duties |
|---|---|---|---|
| You use the OpenAI API in your own application | Deployer | Rest with the model provider | Human oversight, transparency and AI literacy |
| You integrate an API into an HR system sold to customers | AI-system provider | Rest with the model provider | Full AI-system provider duties, potentially for a high-risk system |
| You substantially fine-tune a model and release it under your brand | Potentially a GPAI provider | Rest with you | Full Chapter V AI Act duties |
| You release a modified open-source model | Potentially a GPAI provider | Rest with you if compute thresholds are exceeded | Depends on downstream use |
Meta did not sign the GPAI Code. What does that mean for Llama users?
Meta refused to sign the GPAI Code, accusing the EU of excessive regulation. If your company uses Llama models, you need to understand the consequences.
The open-source exemption: what it covers and what it does not
Article 53(2) of the AI Act exempts providers of open-source models from documentation duties, including technical documentation and information for downstream users, provided that model parameters, weights, architecture and usage information are made publicly available.
The exemption has three limits:
- It does not cover models with systemic risk. An open-source model exceeding the 10^25 FLOPs threshold is subject to the full duties.
- It does not exempt copyright duties. A copyright policy and a summary of training data are required from every GPAI provider, including open source.
- It does not protect deployers. Your duties as a deployer remain unchanged regardless of the model provider’s status.
Three ways to demonstrate AI Act compliance
Meta’s refusal to sign does not make Llama models illegal in the EU. It means that Meta must demonstrate compliance by other means, which affects your risk as an integrator.
| Route | Legal basis | Presumption of conformity | Risk for your company |
|---|---|---|---|
| GPAI Code | Article 53(4) and Article 56 | Presumption in practice | Low: the provider has a privileged position |
| CEN/CENELEC harmonised standards | Commission mandates | Full presumption after publication in the Official Journal of the EU | Low, but the standards are not yet ready |
| Alternative measures | Second sentence of Article 53(4) | No formal presumption; the Commission assesses conformity ex post | Higher: the provider bears the burden of proving conformity |
Meta chose the third route. For you as a CTO or founder, that means:
- Review agreements with AI model providers. Check who bears responsibility for AI Act compliance and what assurances the provider gives.
- Assess contractual risk. If the provider has not signed the Code, your position during an inspection may be weaker.
- Prepare a backup plan if you use Llama models, in case the absence of the Code creates additional duties for you as an integrator.
- Consider the effect on purchasing decisions. A provider’s signature on the Code, such as OpenAI, Anthropic or Mistral, gives more regulatory predictability than using a provider that has not signed.
The Grok case: a warning for every company with an AI chatbot
Alongside the AI Act debate, the Commission is conducting formal proceedings against platform X under the Digital Services Act (DSA). In December 2025, it imposed the first DSA fine in history: EUR 120 million. In January 2026, it opened a separate proceeding concerning the Grok chatbot, which generated hate speech and made inappropriate sexual content available, including to children. Poland filed an official complaint with the Commission.
Why this matters to your company even if it is not a social-media platform:
- An AI chatbot in your product can generate unlawful content. A lack of content moderation creates liability risk.
- The DSA imposes content-moderation duties on platforms designated as Very Large Online Platforms, but the AI Act extends transparency and safety requirements to all AI-system providers.
- The Grok case shows that regulators treat AI-generated content like other content. Lack of content safety in a chatbot may trigger proceedings.
Test your chatbot for unlawful outputs, implement moderation procedures and document the test results.
How much does AI Act compliance cost?
There is no firm empirical data on compliance costs for startups and SMEs. The only publicly available estimate cited here comes from industry consultations by the Digital Poland Foundation: small companies estimate annual AI Act compliance costs of up to EUR 200,000. This is indicative only. Actual costs depend on your company’s role, number of AI systems, risk level and current documentation.
| Cost category | Main activities | Who it concerns |
|---|---|---|
| Technical documentation | Architecture, parameters, training data and test results | GPAI providers |
| Quality management system | Policies, procedures and responsibility structures | Providers of high-risk AI systems |
| AI literacy and training | Employee training and educational materials | Everyone; in force since 2 February 2025 |
| Risk management | Risk identification, testing, validation and reviews | Systemic-risk GPAI providers and deployers of high-risk systems |
| Transparency and content labeling | Label AI-generated content and inform users | Deployers of AI systems |
| Data protection | DPIA, updated records and security measures | Companies processing personal data with AI, including AI Act/GDPR interaction |
Potential penalties are another cost to consider:
| Type of infringement | Maximum penalty |
|---|---|
| Use of prohibited AI practices | Up to EUR 35 million or 7% of annual global turnover |
| Failure to meet high-risk system duties | Up to EUR 15 million or 3% of global turnover |
| Failure to meet GPAI provider duties, such as documentation or training-data summary | Up to EUR 7.5 million or 1.5% of global turnover |
| Providing false information to supervisory authorities | Up to EUR 7.5 million or 1% of global turnover |
The Commission may also require a GPAI model to be withdrawn from the EU market in case of serious and justified systemic risk, under Article 93(1)(c) of the AI Act.
What you should do over the coming months
Here are seven steps, ordered by priority, from actions to take immediately to those to plan for the next few quarters.
Immediate actions
- Determine your role in the AI value chain. Check whether your company is a GPAI provider, AI-system provider or deployer. The scope of your duties depends on this. Use the Commission’s new GPAI guidance for definitions, compute thresholds and borderline scenarios.
- Review the GPAI Code of Practice and assess whether your organization should sign voluntarily. For GPAI providers, signing is the easiest route to demonstrating conformity. For deployers, check whether your model providers have signed.
- Review agreements with AI model providers. Check who is responsible for AI Act compliance, what assurances the provider gives and what happens if it has not signed the Code. If you use Meta Llama models, assess the risk arising from the absence of a presumption of conformity.
- Implement or update AI content-moderation procedures. The Grok case shows that an unmoderated chatbot may trigger regulatory proceedings. Test your chatbot for unlawful content and document the results.
Actions over the next 1 to 3 months
- Prepare technical documentation. For a GPAI provider, it must cover architecture, parameters, training data, evaluation results and estimated energy use. The Commission provides a standardized form. The duties have applied since 2 August 2025.
- Plan AI literacy training for your team. The duty has applied since 2 February 2025 and covers everyone involved in designing, developing, deploying or overseeing AI systems. Include C-level executives so management understands the difference between GPAI-provider and deployer duties.
Actions to monitor
- Follow developments concerning Meta and open-source models. If you use Llama, prepare a backup plan if the lack of the Code creates additional duties for you. Also monitor CEN/CENELEC work on harmonised standards, which will provide another route to demonstrating conformity when published.
How we can help you prepare for the AI Act
The AI Act will not wait for companies to be ready. GPAI duties are already in force, and the Commission’s enforcement powers, including the ability to impose fines and require market withdrawal, begin in August 2026.
We combine legal advice with an understanding of how technology teams work. Rather than treating contracts, IP and AI as separate workstreams, we combine them into one model suited to your product.
Our AI Act support includes:
- Classifying your company’s role: determining whether you are a GPAI provider, AI-system provider or deployer, and mapping the resulting duties.
- Auditing AI model-provider agreements: reviewing who bears compliance responsibility, what assurances are given and how risk is allocated when a provider has not signed the Code.
- Preparing technical documentation under the AI Act and GPAI Code.
- Reviewing the GPAI Code and whether signing it is the best route for your organization.
- Reviewing AI content-moderation procedures and chatbot safety requirements.
- Preparing a compliance roadmap aligned with your business model and AI Act deadlines.
GPAI duties will not wait. Start by classifying your role
The AI Act has not been postponed. The GPAI Code has been published. Penalties for GPAI provider breaches may reach EUR 7.5 million or 1.5% of global turnover. The Commission may require a model to be withdrawn from the EU market.
Your first step is to determine your company’s role in the AI value chain. That determines which duties apply, what documentation you need and when it is due. For support with role classification, model-provider agreement audits or a compliance roadmap, contact us. We can help define your obligations and prepare for deadlines that are already running.
Frequently asked questions
Does the AI Act apply if my company only uses an OpenAI or Anthropic API and does not build its own model?
Yes, but in a limited way. As a deployer, you have duties under Chapters III and IV of the AI Act, including human oversight, user transparency and AI literacy for your team. GPAI model-documentation duties rest with the model provider. If you substantially modify a model and release it under your own brand, you may be treated as a GPAI provider with the full set of duties.
Does Meta’s refusal to sign the GPAI Code mean that I cannot legally use Llama models in the EU?
No. Using Llama models in the EU remains legal. Not signing the Code is not itself a breach of the AI Act. It means that Meta must demonstrate GPAI conformity by “other appropriate means,” assessed by the Commission under Article 53(4). For you as an integrator, this creates higher regulatory risk because the provider lacks a presumption of conformity. Review your Meta agreements for how responsibility is allocated.
What duties apply to my company when it uses GPAI models?
As a deployer, you must provide AI literacy training, use the system in accordance with the provider’s instructions, inform users that they are interacting with AI, monitor system operation and inform the provider of irregularities. If your system is high-risk, for example an HR or credit-scoring system, additional duties may include a fundamental-rights impact assessment (FRIA), keeping logs for at least six months and assigning oversight to competent people.
Could an AI chatbot expose my company to liability even if I am not a social-media platform?
Yes. The Grok and X case shows that regulators treat AI-generated content like other content. A lack of moderation where a chatbot generates unlawful content, such as hate speech or sexual content accessible to children, may trigger proceedings under the DSA if your platform meets its criteria, and under the AI Act’s transparency and safety duties. Test your chatbot for unlawful outputs and document the results.
When may the Commission impose penalties for AI Act violations?
The Commission’s full powers to penalize GPAI-duty breaches begin on 2 August 2026. That does not mean you can do nothing until then: documentation and information duties have applied since 2 August 2025, and the Commission may already request information and assess models. Penalties for GPAI provider breaches may reach EUR 7.5 million or 1.5% of global turnover. Use of prohibited AI practices has been prohibited since 2 February 2025 and may be penalized by up to EUR 35 million or 7% of turnover.
How much does AI Act compliance cost a small technology company?
There is no firm empirical data. The only public estimate cited here is from Digital Poland Foundation industry consultations: small companies estimate annual costs of up to EUR 200,000. Actual costs depend on the company’s role, number of AI systems, risk level and existing documentation. A deployer using one API will generally face lower costs than a systemic-risk GPAI provider.
