EU rules on AI models become enforceable. What’s going to change?

As of today, the EU’s rules on AI models become enforceable, cementing the European Commission’s role as the world’s most prominent regulator of this disruptive technology. Euronews takes a deep dive into what the rules mean for Europe and beyond.

The AI Act is the first comprehensive law regulating artificial intelligence. Passed in 2024, some of its most significant provisions — notably those regulating large language models — become applicable this August.

As the law introduces first-of-its-kind rules, enforcing them presents a unique set of challenges, not least because new generations of AI technology emerge every few months. Brussels’ experience is likely to resonate well beyond Europe’s borders.

What are the rules about?

Initially, the AI Act was only meant to regulate AI applications. But when the public launch of ChatGPT took the world by storm in 2022, EU policymakers decided also to cover the underlying technology: large language models.

The rulebook sets out rules for all models that lack a specific purpose but can be adapted to a variety of use cases, requiring transparency on how a model was built, disclosure of any copyright-protected content used for training, and enough information for downstream users to understand the model’s capabilities.

Additional requirements fall on companies developing the most powerful “frontier” models — those pushing the boundaries of the technology — compelling AI firms to identify and mitigate risks to society at large.

Last year, the Commission endorsed a voluntary code of practice drafted by world-leading experts, including Yoshua Bengio, detailing how developers should comply with the rules. Most leading Western AI labs, with the notable exception of Meta, signed the code.

“We’ve collaborated closely with the European Commission and the wider ecosystem on implementing the AI Act, including its Codes of Practice, and will continue working together to help Europe realise the benefits of the Intelligence Age,” Tom Duff Gordon, OpenAI’s Vice President and Head of EMEA Policy, told Euronews.

What challenges lie ahead?

The Commission set up the European AI Office to drive enforcement of the AI Act’s rules on AI models. The task is enormous, taking on one of the most complex technologies of our time and some of the richest companies in the world.

The EU’s resources are knowingly limited, and AI talent is in high demand, with public authorities competing with the private sector. The Commission is therefore seeking to tap into external expertise, namely a panel of scientists and a pool of highly specialised AI safety firms.

Still, AI in general, and frontier models in particular, remain a moving target: officials will have to keep pace with fast-moving technological developments without much prior experience or scientific consensus on how to prevent harm at scale.

At the same time, any decisive action from Brussels in this area is bound to draw the attention, if not the ire, of Washington, with the Trump administration particularly assertive in attacking the EU’s digital rules when they affect American companies.

“The danger is that the current US administration treats this as an attack on US commercial interests, as it did when the Commission sought to implement its digital markets’ rules in December 2025 and more recently this month when it sought to fine Google under the EU’s Digital Markets Act,” MEP Michael McNamara (Ireland/Renew) told Euronews.

What does it mean for Europeans?

The AI Act’s core purpose is to make technology safer for European citizens, ensuring it does not harm their safety and fundamental rights. As such, it also applies to foreign companies that commercialise their AI technologies in the EU.

The industry has repeatedly attacked the law, arguing that it will slow innovation by placing an unnecessary burden on tech companies, forcing them to divert money from hiring engineers to hiring lawyers to handle the paperwork.

In practice, for European consumers and businesses, that might mean some of the most advanced AI models launch in the EU a few weeks later than in other markets, as firms ensure they have done their compliance homework.

Still, it will also mean that, at least in theory, Europeans can trust that if an AI model is available in the EU, it is safe to use. Given how embedded AI is becoming in everyday products and services, that time lag might be worth it.

MEP Axel Voss (Germany/EPP) called on the Commission to enforce the AI Act in close alignment with other digital issues, since AI technologies are increasingly embedded in connected products and online services.

“Taking the AI Office’s lack of capacities into account, I very much hope that they do not waste their energy on niche concerns but instead align strongly with the priorities of their platform regulation colleagues,” Voss told Euronews.

Is the EU setting the benchmark?

As the Commission has become the world’s most prominent AI regulator, it will inevitably set the benchmark for how public authorities approach the technology, especially since other jurisdictions have taken a more wait-and-see approach.

That is why the enforcement priorities the AI Office sets for itself are bound to have an impact well beyond Europe’s borders — not to mention the so-called “Brussels effect,” the EU’s capacity to set compliance standards for global companies.

There are two main schools of thought on the main risks AI regulation should address. The AI ethics tradition focuses on fundamental rights violations, such as discrimination and privacy, and the need to ensure human oversight.

Effective altruism, by contrast, emphasises so-called existential risks: the possibility that AI could cause catastrophic harm by helping build nuclear or biological weapons, enabling massive cyberattacks, or escaping human control altogether.

Recent episodes — Anthropic’s Mythos-based model being pulled under US export control restrictions over concerns about its cyber capabilities, and an OpenAI AI agent hacking into an AI firm during testing — might push the Commission to focus its scarce resources solely on existential risk scenarios.

“The Commission must resist the temptation to devote its enforcement resources solely to cyber-offence and loss-of-control systemic risks,” Laura Lazaro Cabrera, a director at the Center for Democracy & Technology, told Euronews.

“Enforcement should not be headline-driven, but should address the full spectrum of risks and ask whether fundamental rights and societal risks have been adequately considered,” she said.