The European Union's Artificial Intelligence Act imposed binding obligations on providers of general-purpose AI models — the large models underlying contract-review and legal-research tools — as of August 2, 2025, under the compliance timeline that entered into force with the Act on August 1, 2024. The duties apply regardless of where the provider is domiciled if the model is placed on the EU market, which pulls US legaltech vendors selling into European customers inside the perimeter. 3G Times publishes information, not legal advice.
What changed in August is the general-purpose-model tier: providers must publish detailed summaries of the content used to train their models, put a copyright policy in place, and — for models trained with compute above the threshold the Commission set — meet systemic-risk assessment and reporting duties. Unacceptable-risk prohibitions, including social scoring, have applied since February 2, 2025. The high-risk tier most relevant to legal workflows, including AI used in employment screening and credit decisions, carries obligations from August 2026, with some provisions extending to 2027 under the timeline Reuters has tracked since entry into force.
Why does a model rule matter to legaltech buyers?
Because the obligation lands on the model provider, not the application vendor, the immediate compliance question for law firms and legal-ops teams is contractual: vendors reselling model access must flow the Act's transparency artifacts — training-content summaries, copyright policies — down to enterprise customers whose own EU exposure differs from theirs. Procurement teams that added AI clauses in 2024 on the assumption that duties would sit entirely with the vendor are finding that data-processing and use-restriction duties attach at the deployer level too.
The Commission published the template for training-content summaries in July 2025, weeks before the deadline, leaving providers a short runway to file. That late template, not the statute itself, is what compressed vendor timelines this summer.
What happens next on the calendar?
Three dates order the roadmap for legal and compliance teams. Governance provisions, including member-state regulator designation, applied from August 2024. The general-purpose tier took effect August 2, 2025. The high-risk tier — the classification that captures AI in hiring, credit, and essential services — begins August 2, 2026, with embedded-product deadlines in 2027. Fines scale to 35 million euros or 7 percent of global annual turnover for the prohibited-practices tier, per the Act's penalty chapter.
What the record establishes is a staged statute now binding on two of its three tiers. What remains unknown is enforcement appetite among national authorities still staffing up; that will be set in practice, not in the text.