EU: Regulatory developments concerning the AI Act

Why should I read this? 

The EU is at a crossroads on digital rules. Regulators increasingly have to weigh principled, sustainable frameworks against competitiveness, simplification and innovation. This challenging steer is intensified by geopolitical pressures, such as trade negotiations and defense strategies. Businesses have the opportunity to engage with regulators, but will need to apply existing laws conservatively. 

Since February, regulatory developments in AI have included:

• the publication of two key European Commission (EC) guidelines on AI system definitions and prohibited AI practices 
• the announcement of a Digital Omnibus package, which remains in consultation and drafting stages and is expected in late 2025
• the publication of the AI Continent Action Plan, an ambitious plan to become a global leader in AI
• intense activity regarding a potential ‘stop-the-clock’ of the AI Act (the Act)
• the publication of the General Purpose AI Code of Practice (the Code)

On August 2, 2025, key obligations under the AI Act became theoretically applicable, particularly those outlined in Chapter 5 concerning GPAI models, and Article 78 addressing data confidentiality and intellectual property rights. However, the EC has clarified that full enforcement is progressive: providers currently have until August 2026 to achieve full compliance without risk of immediate enforcement action. Existing GPAI model providers have an extended deadline until August 2027. These grace periods reflect EC guidance and communicated intent, but actual implementation may vary across Member States.

This shows that the EU is willing to simplify and soften digital rules, but it will not sacrifice entirely its global standard setters, such as the Act. 

What is the state of play of the GPAI Code and the AI Act?

After weeks of intense lobbying and geopolitical pressures, suggestions to soften the Code were implemented. The Code was published on July 10 and marks the end of a year-long, multi-stakeholder drafting process involving over 1,000 participants from industry, academia, civil society, and EU institutions. It contains three chapters: 

• transparency
• copyright
• safety and security

The first two are relevant for all providers of general-purpose AI models, while the chapter on safety and security applies only to providers of GPAI models with systemic risk (i.e. models capable of causing large-scale harm). Providers are permitted to commit selectively to certain chapters of the Code.

The EC also published:

• guidelines on general-purpose AI. These clarify who is in and out of scope of the AI Act’s GPAI rules
• a template for summarizing the sources used to train AI models, a critical and politically sensitive topic

These documents are relevant for legal certainty and practical compliance - especially on copyright and data transparency.

The EC recently published an updated list of signatories, including major industry players. Thereafter the Code was confirmed by the EC and the EU Member States. 

Despite these advancements, the actual implementation remains somewhat uncertain, as national authorities tasked with overseeing compliance and enforcement are not yet fully designated. EU Member States are required by the AI Act to appoint relevant authorities and report on their resources by August 2025, but this remains a work-in-progress.

What are key takeaways for businesses?

EU regulators are engaging with businesses in an effort to address their concerns via simplification, even regarding core EU law. However, the recent activity concerning a potential ‘stop-the-clock’ related to AI legislation suggests that the process will be measured. This is indicative of the upcoming Digital Omnibus Package, which will likely aim to simplify some digital rules, including GDPR. Businesses have a rather unique chance to share their views with lawmakers in these areas. 

Given the uncertainty surrounding enforcement, companies should strategically leverage the transitional compliance period, particularly through modular commitments to the GPAI Code, to mitigate future regulatory risks effectively.

What impact is foreign policy having on EU AI laws?

The US administration had leveraged tariff and market access concerns to achieve regulatory flexibility on AI. However, for the EU, the only acceptable reason to delay the Act would have been that the GPAI codes were not ready. This is now the basis for the said grace period. Foreign policy may have weighed in on the final version of the Code, but the political reality of EU law making needs to be taken into account. 

Core legislation in the EU, such as the Act, is not amended easily. A proposal by the EC to ‘stop-the-clock’ on the Act requires support from the Council and European Parliament (EP). While it appears strong in terms of simplification, major political parties have voiced concern about the fast-tracked changes. Moreover, a recent debate in the EP on a motion of censure against the President of the European Commission shone a light on the mounting tensions between the right and center-left parties in the EU. Arguably, the motion of censure and the launch of the Danish Presidency in Council may have shifted policy in the EU back toward a more “sustainability-focused” approach.

Co-authored by Pia Krökel Caruana (Knowledge).

Further information on the EU AI Act and omnibus package

• Global AI Regulatory Update - March 2025 | Eversheds Sutherland
• EU AI Act - Legal issues around AI
• EU: Omnibus Sustainability Directive reforming sustainability reporting and due diligence | Eversheds Sutherland
• Global insights: Illuminating your EU AI Act compliance needs  - Eversheds Sutherland