EU AI Act: know which obligations are yours

On 18 July 2025, the European Commission published guidelines on the scope of obligations for providers of general-purpose AI models, ahead of their application on 2 August 2025. This analysis uses that historical guidance to explain the importance of roles; it does not announce a new October 2026 enforcement deadline.

The Commission describes provider duties including documentation for downstream users, a copyright compliance policy and a public summary of training content. Models with systemic risk have additional obligations involving evaluation, incident reporting and cybersecurity. Requirements depend on the applicable role and model category.

A company may buy a model, integrate it into a service, distribute a system or deploy a vendor’s application internally. Those are not interchangeable activities. Before assigning a compliance checklist, describe what the company actually does in the AI value chain and obtain qualified advice about the relevant legal role.

Do not infer legal classification from a product’s marketing name or from whether it uses generative AI. The intended purpose, integration and applicable rules matter. This is a management overview, not legal advice or a guarantee that a particular system complies.

Ask who provides the model and who is responsible for the application that your employees use. Request the documentation relevant to your integration, the process for communicating material changes and the contact point for incidents. A generic statement that a product is responsible AI does not answer those questions.

Clarify how your own data is handled, which access controls apply and what evidence you can obtain if an output or action is challenged. Keep privacy, security, copyright and AI Act questions distinct enough that someone owns each answer, while considering their effects together.

Create an inventory connecting each system to its purpose, owner, supplier and permitted use. Start with the decisions that can materially affect people rather than treating a writing assistant and a consequential decision system as identical.

The AI security and governance analysis explores operational controls. The agent safety article explains why permission boundaries and testing matter when software can act. Neither replaces a legal assessment, but both help translate governance into observable behaviour.

For healthcare-related AI, avoid assuming that generic advice covers the setting. The Notana case introduces work in that domain; it does not establish a compliance status for your own service or a medical effectiveness claim.

Choose one system and try to produce a coherent explanation of its purpose, legal role, supplier evidence, access boundaries and human oversight. Where the account breaks down, identify the missing owner or evidence rather than immediately buying another template.

A keynote on AI and leadership can establish shared vocabulary. AI advisory can help prioritise the business questions, while current deadlines, classifications and legal interpretations should be checked against official sources and qualified counsel.