Second AI Act Milestone as of August 2025 & Codes of Practice für GPAI
Another set of provisions of the AI Act is coming into force. Furthermore, the newly published GPAI Code of Practice provides support for implementation.
August 2, 2025, marks the second milestone in the gradual entry into force of the AI Act. In addition to the full applicability of the provisions on governance, enforcement, and sanctions, in particular, the provisions for General Purpose AI (GPAI) are now applicable. The GPAI Code of Practice recently published by the European Commission offers providers of such AI systems and models guidance on implementing the GPAI-specific provisions.
The most important points at a glance – the following changes will apply from August 2, 2025:
- Obligations for providers of GPAI apply.
- The three-part Code of Practice on GPAI provides support for implementation.
- National authorities are designated, and most sanctions will take effect.
The AI Act provides for a gradual timeline for the entry into force of its provisions. While the prohibitions on certain AI practices and the requirements regarding AI competence have been in effect since February 2025, the provisions on governance, enforcement, and sanctions will apply from August 2, 2025. From this point on, member states must designate a market surveillance authority, a notifying authority, and a notified body to ensure compliance with the regulations. In Germany, the Federal Network Agency is taking on the tasks of the market surveillance authority, which is currently gradually taking up its work.
Violations of the prohibitions and other obligations can then be punished with heavy fines. These sanctions under the AI Act can now be imposed by the supervisory authorities for the first time from August 2025. Not only are high fines now to be imposed for non-compliance with the prohibition of certain AI practices under Article 5 of the AI Act but also sanctions for violations of GPAI regulations take effect. It should be noted that the sanctions do not initially apply to high-risk AI systems, as the regulations for most high-risk AI systems will enter into force no earlier than August 2, 2026.
A central part of this milestone is the regulation of general-purpose AI (GPAI). GPAI models trained for a variety of applications are subject to specific transparency, documentation, and copyright requirements. GPAI models with "systemic risk" are also subject to stricter obligations. To support the practical implementation of these requirements, a GPAI Code of Practice was recently published by the European Commission. With its three separate chapters on security, transparency, and copyright, the practical guide serves as an aid in handling the requirements of the AI Act until a harmonized standard is published. In addition, the Code of Practice is soon to be supplemented by guidelines. A harmonized standard, which is yet to be published, will then serve as a presumption of conformity for providers of GPAI models to demonstrate compliance with the provisions of the AI Act. This Code of Practice promotes harmonization and transparency in the use of GPAI and provides guidance for all affected stakeholders. It is thus a key tool for the practical implementation of the GPAI rules from the second milestone of the AI Act forward.
Although the GPAI requirements will ultimately not affect the majority of companies, all stakeholders should nevertheless prepare themselves adequately for the validity of the sanctions. Providers, but also all other operators under the AI Act, should verify their compliance with the applicable obligations.
Our qualified team of experts at Deloitte Legal will be happy to support you in implementing the requirements on your path to compliance. Get in touch with us!
