Implementation of the AI Act – What Happens Next

What You Need to Know

There are indications that the European Commission may consider postponing the provisions of the EU’s AI Act scheduled to begin this August.

These provisions include empowering the European Commission to impose substantial fines for providers that are deemed to pose a systemic risk.

Despite the possibility of a postponed timeline, organisations should not delay their preparations.

Background

The AI Act came into force on 1 August 2024, with provision for phased implementation. The phased roll-out is scheduled to complete by 2 August 2027, when the law will apply in full across the European Union (“EU”).

The first phase, which started on 2 February 2025, introduced rules banning certain types of artificial intelligence (“AI”) systems that the AI Act deems unacceptable (namely “prohibited AI systems”). Also included are obligations surrounding AI literacy that ensure employees using AI systems have the requisite skills and training to do so in an appropriate and ethical manner.

General Purpose AI Models (“GPAI Models”)

The AI Act defines GPAI Models broadly as AI models capable of carrying out many different tasks using large amounts of data, often trained using self-supervision. These models can be integrated into a wide range of other software and applications. Well-known large-scale AI tools, such as ChatGPT, fall within this category.

Under the AI Act, providers of GPAI Models have specific responsibilities, including:

• Preparing and keeping detailed technical documentation for the GPAI Model;
• Providing the information specified in the AI Act to anyone who wants to incorporate the GPAI Model into their own products or services;
• Having a policy in place to ensure compliance with relevant EU laws on copyright and related rights. This policy must acknowledge that copyright holders can reserve their rights in respect of data mining; and
• Publishing a summary of the main materials used to train the GPAI Model, using a template that will be supplied by the future EU regulatory body (“AI Office”).

If the European Commission deems that certain GPAI Models pose a “systemic risk”, extra obligations will apply. From 2 August 2025, the European Commission may impose substantial fines on providers that fail to meet these requirements, amounting to either 3% of their total worldwide turnover from the previous financial year or €1.5 million, whichever is larger.

Code of Practice for GPAI Models

In addition to these obligations on providers, the AI Act mandates that the AI Office publish a voluntary “code of practice” to guide compliance with Chapter V. Although it is not compulsory to follow this code, it will reflect the EU’s expectations of how GPAI Model providers should behave. Similar to the way the European Data Protection Board (“EDPB”) issues guidance for the General Data Protection Regulation (“GDPR”), this code is likely to be seen as the standard that GPAI Model providers ought to meet.

The code is being developed with input from ‘general-purpose AI model providers, downstream providers, industry organisations, civil society, rightsholders and other entities, as well as academia and independent experts’ according to the AI Office. The AI Act set a May 2025 deadline for the AI Office to prepare a draft of this code and requires the final version by 2 August 2025. Three drafts of the code of practice have been published to date with nearly 1,000 participants attending the kick off plenary session to begin development of the code. As the code remains in draft form, there are concerns that providers will have little or no time to implement it before the relevant provisions of the AI Act take effect.

Delay in Implementation

There are indications that the European Commission may consider postponing the next parts of the AI Act’s roll-out, possibly affecting the provisions scheduled to begin on 2 August 2025. Several factors are thought to be driving this potential delay, such as the late publication of key technical standards (including the GPAI Model code of practice) and calls from the technology industry and trading partners like the United States to avoid excessive regulation in this area. The European Parliament is due to break for the summer in the coming weeks so any decision on pushing back the implementation of the AI Act will need to be made as a matter of priority.

This potential deferral is part of a broader effort to reduce the regulatory load on small and medium-sized enterprises (“SMEs”) across the EU, including through so-called “Omnibus Packages”. These initiatives aim to streamline compliance frameworks for SMEs and enhance innovation by easing some of the more burdensome rules. While the AI Act is specifically mentioned in the European Commission’s simplification plan, the exact scope of any change remains uncertain.

Next Steps

It is important to remember that no official decision has been made to suspend or delay the AI Act. Unless and until such a decision is announced, organisations are encouraged to continue with their compliance preparations. Even if there is a change to the timeline, firms remain exposed to a fast-moving AI regulatory landscape that calls for robust risk management, strong governance, and effective internal controls with the bulk of the AI Act’s obligation for AI providers and users currently scheduled to apply from 2 August 2026.

Further Information

For more on our AI updates, please see our AI Advisory page¹.

If you would like to discuss the topics considered here or require any further information, please liaise with your usual Maples Group contact or any of the persons listed on this page.

¹ https://maples.com/services/specialty-services/ai-advisory