Засяга ли AI Act вашия бизнес? | Адвокатска кантора "KGK"

Artificial intelligence is no longer just a technological topic. It increasingly affects contracts, copyrights, business models, regulations, and real responsibilities for companies.

As of August 2, 2025, some of the obligations under Regulation (EU) 2024/1689, better known as the Artificial Intelligence Act or AI Act, have begun to apply. These rules are aimed at providers of general-purpose AI models, known as GPAI models.

This is an important moment because the requirements for transparency in the training of AI models and the use of copyright materials are no longer just principles on paper. They are becoming concrete obligations.

If your company develops fine-tunes, or integrates GPAI models, these rules affect you directly.

What do providers of GPAI models need to know?

The new obligations are primarily related to transparency and compliance with intellectual property rules. In practice, providers must be able to show that they use content lawfully and that they have clear internal rules for this.

What are the main requirements?

Copyright compliance policy.

Providers of GPAI models must implement and maintain a policy that ensures compliance with EU law on copyright and related rights.

This policy should not be just a formal document. It should include mechanisms for recognizing and respecting the rights of authors and rights holders.

Particularly important is the so-called "opt-out" right—the ability for rights holders to state that they do not want their content to be used for certain purposes, including training AI models, including through machine-readable signals such as as robots.txt . In other words, if a site has clearly stated that its content cannot be used in this way, the model provider must comply.

Lawful access to content

When collecting data from the internet, providers must only use content to which they have lawful access.

This means that technical protection measures, such as paywall, cannot be circumvented. Sites known for copyright infringement should also not be used.

The focus here is on the origin of the data. The question is no longer just what can technically be extracted from the internet, but whether that content can be lawfully used.

Sufficiently detailed summary of the training data.

Providers are obliged to publish a public summary of the content used to train the model, according to a template issued by the European AI Office in July 2025. This obligation is fully binding on all providers of GPAI models.

The goal is to have more clarity about what type of content was used in training the model. This does not necessarily mean disclosing every specific data unit, but it requires enough information to achieve real transparency.

What is a Code of Conduct and why is it important?

Along with the entry into force of these obligations, the European Commission also published a Code of Conduct for GPAI models.

The Code itself is not legally binding. However, it has practical significance. Providers who adhere to it can refer to their compliance to demonstrate conformity with the Regulation.

Those who do not adopt it will have to prove their compliance in another way. They will also have to explain to the AI Office how they meet the requirements.

In practice, the Code is likely to become a benchmark for what regulators expect. Many of the future rules and guidelines for the activities of GPAI models will likely be built around it.

What are the deadlines?

The deadlines vary depending on when the model was placed on the market.

Models placed on the market after August 2, 2025, must comply with the new requirements immediately.
Models that were already on the market before this date have a grace period until August 2, 2027.
The European Commission's enforcement powers for these rules will apply from August 2, 2026.

It is also important to consider the extraterritorial scope of the Regulation. The transparency obligations may apply to providers who fall within the scope of the AI Act, regardless of where the model was trained. The aim is to ensure a level playing field for developers in the European Union.

What are the penalties?

In case of non-compliance with the obligations, the penalties can be significant.

The foreseen penalties reach up to 15 million euros or up to 3% of the annual worldwide turnover of the GPAI model provider for the preceding financial year.

This makes the topic important not only for technology teams but also for management, legal departments, compliance teams, and all companies working with AI solutions.

What can businesses do now?

Although there is a grace period for some models, preparation should not be delayed. The new rules require time—both for legal analysis and for technical and contractual preparation.

Businesses should assess whether they fall within the scope of the Regulation. Attention should be paid to cases of model fine-tuning. In certain situations, a participant may become a provider of a GPAI model if the computing power used exceeds one-third of that used for the training of the original model.

Here is what we recommend:

Review contracts for licensing training data, as well as the entire supply chain.
Check where the data comes from, under what conditions it was provided, and whether its use complies with applicable rules.
Introduce or update a copyright policy with clear mechanisms for respecting the reservation of rights, including when expressed through machine-readable signals.
Begin preparing the technical documentation and the summary of the training data according to the AI Office's template.

Why is this important?

The EU's regulatory framework in the field of artificial intelligence is developing rapidly. Obligations are becoming more specific, and the responsibility for businesses is becoming more real.

Companies that use or develop AI solutions must now think not only about technological capabilities but also about content rights, process transparency, and their readiness to demonstrate compliance.

If you have questions about how the new rules specifically affect your business, the KGK team is available to assist you.