EU AI Act obligations begin to bite for frontier-model vendors

The EU AI Act’s obligations for general-purpose AI models are starting to move from text to practice. Frontier-model vendors have begun publishing technical documentation and summaries of the training content used for their largest systems, one of the first concrete requirements to apply to general-purpose models.

The early disclosures vary considerably in depth. Some vendors have published detailed model cards covering capabilities, limitations and evaluation results; others have released shorter summaries that leave significant gaps around training data composition and known risks.

Regulators have signalled that they will look at the substance of disclosures rather than their length. The central question is whether a summary lets downstream users and authorities understand the model’s capabilities and limitations well enough to make informed decisions.

For humanitarian and development organisations, the Act matters because they are usually “deployers” rather than developers. Their obligations differ, but they inherit the responsibility of using models whose providers have met their own upstream duties.

A second area of attention is copyright and training-data transparency. The Act requires providers to publish a summary of the content used to train general-purpose models, which has drawn scrutiny from rights-holders and researchers who argue that current summaries are too thin to be meaningful.

Enforcement is still being built out. The AI Office and national competent authorities are staffing up, and the first wave of compliance activity will set precedents for how the rules are interpreted across the single market.

The broader signal is that frontier AI is no longer operating in a regulatory vacuum. Vendors are being forced to treat documentation, risk management and transparency as core product work rather than an afterthought.

Key takeaways

• Frontier-model vendors have begun publishing the first AI Act compliance summaries for general-purpose models.
• The depth of early disclosures varies widely, with gaps around training-data composition and known risks.
• Most humanitarian and development organisations are “deployers”, inheriting duties that depend on providers meeting upstream obligations.
• Training-data transparency is emerging as a focal point for rights-holders and researchers.
• Enforcement capacity is still being built, making the first wave of cases precedent-setting.

Sources

1. European Commission and AI Office guidance on general-purpose AI obligations
2. Frontier-model vendor compliance summaries and model cards, September 2026
3. Legal analysis of AI Act deployer obligations for non-EU organisations
4. Rights-holder and researcher commentary on training-data disclosure