This week you will read a lot of headlines with 35 million euros in big type. It is real, it is the top penalty band of the AI Act, and it is also the worst possible way to understand what happens from 2 August.
Read calmly, the regulation is a different thing: most companies have light obligations that take days to meet. A good share of the fear comes from catchy headlines and from obligations that do not apply.
This is the calm version. What the AI Act is in three ideas, what you owe depending on what you do with AI, where open models fit, and what to have ready so nothing catches you out. For the full detail, with articles and sources, there is our AI Act guide .
The three ideas that matter
First: it regulates uses, not technologies. The regulation does not ask which model you use, it asks what you do with it. And it sorts every use by risk: prohibited (manipulation, social scoring), high risk (decisions about people in employment, credit, education), limited risk (transparency, meaning people should know there is a machine on the other side) and minimal risk, which covers the vast majority and carries nothing special.
The same model can sit in three different categories depending on what you use it for. It is not about the model, it is about the use.
Second: the dates come in phases, and the postponement you have read about is not what it looks like. The regulation has been in force since August 2024. The prohibitions and the staff literacy duty have applied since February 2025. On 2 August 2026 come general application, the transparency obligations and the penalty regime.
And yes, you will have read that it was delayed: the June Omnibus reform moved only the high-risk obligations, to December 2027 and August 2028. Everything else keeps its date.
Third: your role decides your obligations. Using third-party AI makes you a deployer, which is the lightest package. Developing or marketing a system under your own brand makes you a provider, with obligations that follow the risk of the use. And the general-purpose model obligations belong to whoever develops the model, not to whoever uses it.
How it affects you, depending on who you are
If your team uses third-party AI (APIs, assistants, copilots), three things apply and all of them are manageable:
- Documented basic training for the people who use AI, in force since 2025.
- An inventory of which AI you use and what for.
- From 2 August, transparency: if a chatbot of yours talks to people, make it clear it is a machine, and if you publish AI-generated content, label it.
For most teams, that is the whole list.
If you build a product with AI, all of the above plus an honest assessment before you go to market: does your system decide or influence outcomes for people in the Annex III areas, meaning employment, credit, education or essential services?
If not, you are almost certainly not high risk and your load is the transparency one. If yes, the heavy obligations are postponed to 2027 and 2028, but conforming design starts now, because redesigning a system already in production costs three times as much.
If you serve or self-host models, self-hosting does not take you out of the regulation, because your role is defined by the use and not by where the GPUs run. But it does not add the general-purpose model package either.
Why open models help you comply
This is the angle we find most useful and least discussed. Three points, all three backed by the guidelines the Commission published in July 2025.
The model obligations are not yours. The technical documentation, the copyright policy and the training-data summary of a general-purpose model belong to its developer: to OpenAI for GPT, to Alibaba for Qwen, to Z.ai for GLM. The Commission has made it explicit: the provider of the model is whoever develops it and places it on the market under their own name. Using it through an API does not transfer that package to you, and serving a third party's open model, unmodified and identified as what it is, does not either.
What is on you is documenting your use of it.
Fine-tuning has an official rule that is fairly generous. You only become the provider of a model you have modified if the modification is significant, and the Commission indicative criterion is exceeding a third of the original model's training compute. A LoRA or a typical fine-tune lands orders of magnitude below that.
In practice: you can specialise open models for your case without inheriting the base model's obligations. Document the compute you used and you have the evidence.
And the biggest advantage of all: traceability. Much of what the AI Act, and any due diligence, will ask of you comes down to proving which AI you use and how. With open weights you can pin the exact model version, audit it and document your stack top to bottom. With a closed API that swaps models without telling you, that exercise is impossible by design.
What about infrastructure? It matters more than it looks, because not everything is solved by having your servers in eu-west. The data substance of compliance, meaning where processing happens, who can access it and what is retained, is settled by architecture: processing in the EU, zero logs and European jurisdiction. Many hyperscalers cannot guarantee the last one, because they are subject to the US Cloud Act.
That is what we bring, and the guide covers it in detail. But there are two things no infrastructure can do for you, whatever you use: training your team and being transparent with your users.
What to have ready
This is the short version. The full one, with estimated effort and filtered by profile, is in the interactive checklist , which you can tick as you go and download as a PDF.
You should already have this, in force since 2025:
- An inventory of the AI you use: tool, who, what for, what data it touches, provider. One spreadsheet and one meeting.
- Documented basic training for the team that uses AI. One internal session with the evidence kept.
- A one-page AI use policy: what is allowed, which data never goes into a prompt, who to ask.
Before 2 August:
- A machine notice on any chatbot of yours that talks to people.
- A labelling rule for the AI-generated content you publish.
If you build a product:
- A role and risk sheet per system: am I a provider or a deployer? does it touch Annex III?
- Pinned model versions and, if you fine-tune, the modification compute written down. That is your evidence for the one-third rule.
For when someone asks, which will be sooner than you think:
- The evidence folder: inventory, policy, training, your providers' answers and DPAs. Your first AI Act exam will not come from a regulator, it will come from a large client at a renewal or a due diligence. With the folder ready, that question is answered in one email with five attachments.
And this you can cross off your worries:
- There is no mandatory certification to buy. Be wary of anyone selling you an AI Act seal.
- The high-risk obligations are postponed and only apply to the Annex III areas. Most enterprise uses are not there.
- The model obligations are not yours, they belong to whoever develops them.
- If you already comply with GDPR, most of the data work is done. The AI Act adds the layer about use, it does not redo the data layer.
- Nothing has to stop on 2 August. For most teams, what is required takes days.
What happens on 2 August
2 August is the date on which not having done your homework stops being free. And the homework is an inventory, some training, a policy, two transparency notices and an evidence folder. For now, that is all.
If you work with open models on European infrastructure, you arrive with an advantage: the model obligations are not yours, specialisation has a clear rule, and your stack leaves the verifiable trail that everything else is going to ask for.
The full AI Act guide , with articles, sources and dates, and the interactive checklist are both current as of this week. And if you serve open models and want to go through your specific case, write to us : it is literally our ground.
---
*The Commission guidelines on general-purpose models (July 2025) are not legally binding, but the Commission has stated it will base its enforcement on them. Sources: Regulation (EU) 2024/1689, the Commission GPAI guidelines and the official AI Office FAQ. This article is general information, not legal advice.*
