EU AI Act's GPAI Framework Demonstrates Adaptive Regulation Can Keep Pace With AI
Summary
- • Analysis argues the EU AI Act's response to ChatGPT proves adaptive regulation works, not that it failed
- • Original 2021 use-case framework was proactively adapted to address general-purpose AI between 2021–2023
- • Resulting GPAI regime applies tiered obligations: baseline for all, lighter for open-source, stricter for systemic risk models
- • AI Office's Code of Practice operationalizing GPAI obligations was published July 10, 2025
Details
Original Use-Based Framework
April 2021 Commission proposal regulated AI by application risk (e.g., job-screening tools = high risk; spam filters = low risk), with no mechanism to address underlying general-purpose models.
GPAI Gap Identified Early
Future of Life Institute and other stakeholders flagged the GPAI blind spot in the August 2021 public consultation — before ChatGPT existed. ChatGPT made the gap politically impossible to ignore, not newly visible.
Legislative Adaptation Timeline
Slovenia (Nov 2021) floated separate GPAI treatment; France (2022) advanced independent GPAI obligations; Council (late 2022) added GPAI duties; Parliament (June 2023) introduced tiered foundation model regime; trilogue finalized Dec 2023.
Layered GPAI Obligations
All GPAI providers: technical docs, downstream info, copyright compliance, training summary. Open-source: copyright + summary only (unless systemic risk). Systemic risk models: model evaluations, adversarial testing, incident reporting, cybersecurity protections.
Code of Practice Published
The AI Office's voluntary Code of Practice for GPAI compliance, developed with ~1,000 stakeholders, was published July 10, 2025 — the key instrument for demonstrating compliance until harmonized standards exist.
EU AI Act GPAI legislative timeline and obligation structure
What This Means
This analysis directly challenges the dominant narrative that regulators are permanently outpaced by AI — arguing the EU AI Act's GPAI framework is actually a successful case study in structured legislative adaptation. For AI companies operating in the EU, the practical upshot is clear: GPAI obligations are now in force and operationalized through the July 2025 Code of Practice. High-capability model providers face the most stringent requirements, including adversarial testing and incident reporting. The piece also highlights a deliberate design choice — delegating detailed rules to the AI Office rather than locking them in primary law — which builds meaningful flexibility into a fast-moving regulatory space.