The Second Wave of EU AI Act Requirements are In Force: Five Things Business Should Know

In this blog post, authors Avi Gesser, Matt Kelly & Martha Hirst (Debevoise & Plimpton) take a look at the second wave of requirements under the EU AI Act, which came into force on 2 August 2025. These new provisions focus primarily on General Purpose AI (GPAI) model providers and set operational requirements for EU and Member State oversight bodies. While the changes may not directly impact most businesses, they mark a significant step in the EU’s interpretation and application of the Act. GPAI models—those capable of performing a wide variety of tasks across multiple applications—must now comply with rules outlined in Chapter V for models placed on the market from 2 August 2025, with older models given until August 2027 to adapt.

The obligations vary depending on whether a GPAI model operates under an open or closed license but generally include preparing technical documentation for regulators, providing information to downstream users, implementing an AI copyright policy, and publishing a public summary of training data. “Systemic” GPAI systems—defined by their use of significant computing power—face even stricter requirements. While the rules are now in effect, the European Commission’s enforcement powers, such as the ability to demand information, conduct evaluations, remove models from the market, or impose fines of up to 3% of global turnover or €15 million, will not take effect until 2 August 2026.

The Act also requires the establishment of key EU-level regulatory bodies, including the AI Office, the European Artificial Intelligence Board, and the Scientific Panel of Experts, as well as National Competent Authorities in each Member State. While the EU has made progress in operationalizing its central oversight entities, many Member States are behind schedule in creating their domestic enforcement structures. This uneven pace raises concerns about inconsistencies in how the Act may be applied and enforced across different jurisdictions once the full enforcement phase begins in 2026…

CONTINUE READING…