AI regulation and standards

This Future of Life Institute guide explains how the EU AI Act applies to AI systems, including general-purpose AI systems such as Claude or ChatGPT, used for therapy or emotional support. Depending on the system, it may be banned in the EU, classed as high-risk, or subject to transparency obligations, and providers of certain general-purpose AI models must assess and mitigate systemic risks, including risks to public mental health. The European Commission can exercise enforcement powers from 2 August 2026.

The European Commission gained new powers under the EU AI Act to evaluate AI models before public release, restrict their EU market access, and fine providers up to 15 million euros or 3% of annual turnover, whichever is higher. The powers apply to general-purpose AI models offered in the EU regardless of where the provider is based, and they took effect on a Sunday in the staggered rollout of the 2024 law. Lawyers note that refusing an information request or blocking a model evaluation is fineable on its own.

President Donald Trump's AI executive order gave federal agencies 60 days to develop a framework, and the deadline falls on Aug. 1. The order asks AI companies to voluntarily submit their models to the government for evaluation before public release, with Treasury Secretary Scott Bessent, Defense Secretary Pete Hegseth, White House Chief of Staff Susie Wiles and Commerce Secretary Howard Lutnick tasked with setting the specifics. The framework will include a classified benchmarking process to assess models' cyber capabilities.

OpenAI published a statement on its approach to responsible AI in Europe as the EU AI Act enters its next phase. The company says it contributed to and endorsed the EU's General-Purpose AI Code of Practice and the Code of Practice on Transparency of AI-Generated Content. It describes its provenance approach as combining C2PA Content Credentials with SynthID watermarks, and says it is expanding this work to audio outputs.

The Advisory Forum is a general advisory body to the European Commission and the AI Board, established under Article 67 of the EU AI Act to provide technical expertise. The Commission appointed 174 members on 1 June 2026, selected from more than 700 applications, drawn from industry, start-ups, SMEs, civil society and academia. Five bodies, including the Fundamental Rights Agency and ENISA, serve as permanent members.

OpenAI has published its Frontier Governance Framework, which explains how its safety and security practices align with emerging legal requirements, including California's Transparency in Frontier AI Act and the EU AI Act's Code of Practice for General Purpose AI. The framework builds on the existing Preparedness Framework and covers risk assessment and mitigation for cyber offense, CBRN risks, harmful manipulation, and loss of control, along with model reporting, incident response, and framework updates.

Article 50 of the EU AI Act sets transparency obligations for providers and deployers of AI systems in four situations: direct interaction with people, synthetic content generation, emotion recognition or biometric categorisation, and deepfakes or public-interest text. The obligations apply to any AI system in those situations, not only high-risk systems, and to open-source systems, from 2 August 2026.

This overview explains how the European Commission's enforcement powers over general-purpose AI (GPAI) model providers under Chapter V of the EU AI Act will apply. The powers, covering documentation requests, evaluations, measures and fines, take effect on 2 August 2026, while the obligations themselves applied from 2 August 2025.

The EU AI Act classifies AI systems used in employment decisions, including recruitment, selection, candidate evaluation, performance monitoring, and decisions on compliance, contract terms or termination, as high-risk. Both providers and deployers of such systems must meet obligations, including risk assessments, bias testing, human oversight and transparency disclosures, with compliance required by 2 August 2026. The Act may apply to deployers not based in the EU when system outputs affect people in the Union.

Legal compliance professionals explain how modifying an AI system or general-purpose AI (GPAI) model can make the modifier a provider under the EU AI Act, shifting compliance obligations onto them. The shift is triggered when a high-risk AI system is modified or a GPAI model is significantly changed in generality, capabilities, or systemic risk, such as through fine-tuning. The authors state that the European Commission set relatively high compute-based thresholds for substantial GPAI modifications and expects few modifiers to become GPAI providers. Misclassification can lead to fines of up to €15 million or 3% of global annual revenue.

This resource, by Santeri Koivula and Karl Koch, explains the EU Whistleblowing Directive (2019) and how it relates to the EU AI Act. From 2nd August 2026, the Directive explicitly covers reporting violations of the EU AI Act, protecting employees, contractors, suppliers, job applicants and former workers who report them internally, to national authorities, or publicly in certain situations.

On 18 July 2025, the European Commission published draft Guidelines clarifying provisions of the EU AI Act for General Purpose AI (GPAI) models. The Guidelines set the compute threshold of more than 10²³ FLOPs for GPAI classification and 10²⁵ FLOPs for systemic-risk models, and they require providers to notify the Commission within two weeks of reaching that threshold. Once translated into all EU languages, the Guidelines will be formally adopted.

The Code of Practice gives developers of General Purpose AI (GPAI) models a framework for meeting the requirements of the EU AI Act, though providers may demonstrate compliance through other appropriate methods. GPAI rules take effect on August 2, 2025, and Commission enforcement actions begin on August 2, 2026. Models released before August 2, 2025 must comply by August 2, 2027.

This resource presents a non-exhaustive selection of AI literacy programs for organisations and professionals in Europe, aimed at supporting Article 4 of the EU AI Act. Programs were selected for alignment with Article 4, a clear non-technical target audience, accessible format, transparency, and geographic and sectoral diversity. The list reflects publicly available information as of April 2025, and the author, Tânia Figueiredo, notes that no claims are made about legal compliance or endorsement.

The source is a guide to the EU AI Act's provisions for small and medium-sized enterprises (SMEs). It covers regulatory sandboxes that SMEs can access free of charge with priority, assessment fees proportional to company size, simplified technical documentation forms, and dedicated guidance channels.

Austria has set up an AI Service Desk under RTR to support EU AI Act implementation, but its notifying and market surveillance authorities have not been appointed. Belgium, Bulgaria, Croatia, Cyprus, the Czech Republic and other states have named representatives to the AI Board or published lists of designated authorities, with many listed as unclear. Finland's draft implementing act from October 2024 appoints 10 existing market surveillance authorities and is still before parliament.

The European Commission's AI Office has a set of responsibilities under the AI Act, covering AI literacy, registration of Member State decisions on real-time remote biometric identification, and handling of notified bodies. Most of these tasks carry no concrete time frame, and the applicable rules take effect on 02 February 2025 or 02 August 2025 depending on the article.

Member States must designate national authorities that handle AI Act duties, including receiving and registering notifications about real-time remote biometric identification and high-risk AI systems. The source lists specific obligations per authority and says that rules under Article 113(b) apply from 02 August 2025, while the general rule under Article 113 applies from 02 August 2026.

The AI Office and a wide range of stakeholders developed the general-purpose AI (GPAI) Code of Practice, published in July 2025, as a voluntary tool under Article 56 of the EU AI Act. Providers can adhere to it to demonstrate compliance with GPAI model obligations until harmonised European standards take effect, expected August 2027 or later. The Commission and the EU AI Board have confirmed that the Code adequately covers the obligations in Articles 53 and 55.

Novelli, Hacker, Morley, Trondal and Floridi (2024) examine how the European Commission should implement and enforce the AI Act, with a focus on the AI Office and general-purpose AI (GPAI). The source lays out the Commission's tasks, including issuing guidelines on risk-based classification, defining 'significant modifications' under Art 43(4) AIA, and classifying GPAI as posing 'systemic risk' under Art 51 AIA based on criteria such as FLOPs and high-impact capabilities.