Policy Briefing — September 16, 2025

Executive briefing: The EU AI Act entered into force in August 2024, triggering general-purpose AI (GPAI) obligations twelve months later. By September 2025, providers of GPAI models must publish technical documentation detailing training data governance, model capabilities and limitations, and energy use, and must deliver summary descriptions to downstream deployers per Articles 52a–52d. Providers of GPAI with systemic risk must also implement state-of-the-art risk mitigation, conduct adversarial testing, and report serious incidents to the European AI Office within 15 days.

Key compliance checkpoints

Technical documentation. Compile model cards, training data provenance statements, and evaluation reports aligned to Annex IX requirements.
Transparency packages. Produce deployer-facing summaries that describe intended use cases, prohibited uses, and performance limitations, ensuring they are accessible in electronic form.
Compute disclosures. Track total training compute, cloud regions, and energy consumption to satisfy Article 52d reporting.

Operational priorities

Incident management. Establish monitoring pipelines that flag model behavior changes, enabling notification to the AI Office within mandated timelines.
Risk mitigation. Implement adversarial testing, red-teaming, and dataset filtering for systemic-risk models, documenting results and remediation steps.
Distributor governance. Update license terms and onboarding to ensure downstream deployers receive required documentation and accept use restrictions.

Enablement moves

Align internal AI safety councils with EU requirements, ensuring accountability for releasing updated transparency packages whenever models are substantially modified.
Coordinate with sustainability teams to capture verified energy metrics from training runs and data center providers.

Sources

Zeph Tech guides GPAI providers through EU AI Act readiness, from technical documentation workflows to systemic-risk monitoring and incident reporting.