The European Commission published draft Guidelines on 18 July 2025 clarifying how the EU AI Act applies to General Purpose AI models, establishing a compute threshold of 10²³ FLOPs for GPAI classification and 10²⁵ FLOPs for systemic-risk designation. Providers must maintain documentation, publish training data summaries, comply with copyright policies, and those exceeding the 10²⁵ FLOPs threshold must notify the Commission within two weeks and undergo comprehensive risk assessments. The guidelines establish enforcement timelines with the AI Office gaining full enforcement powers on 2 August 2026, while providers of models placed before that date have until 2 August 2027 to achieve compliance.
The EU AI Act's Code of Practice provides a framework for developers of General Purpose AI models to comply with regulatory requirements, with enforcement beginning August 2, 2026 for models released after August 2, 2025, and a compliance deadline of August 2, 2027 for existing models. Key commitments include maintaining comprehensive documentation for at least 10 years, establishing copyright policies that respect machine-readable rights signals like robots.txt, implementing safety and security frameworks with risk assessment and incident reporting within 2 days for critical infrastructure impacts, and ensuring transparency with downstream providers receiving documentation within 14 days. Signatories must assign clear organizational accountability for oversight and retain detailed safety records for a minimum of 10 years, with public disclosure of safety frameworks recommended unless models meet specific safer criteria.
Every AI story that matters,
in your inbox by 8am.
TLDRocket reads all relevant sources, removes duplicate coverage, and summarises the
day in two minutes. Follow companies and topics for alerts, or get the
briefing in Slack. Free, no spam, unsubscribe anytime.
Reading TLDRocket needs no cookies, and the readership counts we rely on come from
our own cookieless analytics. Google Analytics is the exception: it sets cookies and
reports to Google, so it stays switched off until you allow it. You can change your
mind any time from “Cookie settings” in the footer.
Strictly necessary
Session security and form protection (tldrocket-session,
XSRF-TOKEN, 2 hours). The site cannot work without them,
so they need no consent.
Always on
Google Analytics 4 (_ga,
_ga_<id>, up to 2 years). Measures which
stories and sections readers use. Google acts as a third-party processor and may
store the data outside the EU. No advertising, no profiling, no data sold.
