EU AI Act deal separates model duties from deployment risks

European Union negotiators have reached a political agreement on the AI Act, combining rules for particular uses of AI with a separate framework for general-purpose models. The deal reached on December 8 and announced overnight isn’t yet an adopted law: technical work, institutional approval and legal revision remain.

File photo: European flags, © Håkan Dahlström, Spain, 2010. CC BY 2.0, via Wikimedia Commons. Cropped and resized; historical EU illustration, not the announcement.

The important distinction for builders isn’t simply whether their product uses a powerful model. The agreement addresses both the model supplied upstream and what a downstream system is used to do. Those are different sources of responsibility.

Model capability and deployment risk are separate tests

The Parliament announcement describes general-purpose model obligations including technical documentation, compliance with EU copyright law and summaries of training content. Models considered high-impact and capable of systemic risk would face further requirements, including evaluation, adversarial testing, risk mitigation, serious-incident reporting and cybersecurity measures.

High-risk systems are a separate category. The announcements identify sensitive uses such as recruitment, educational access and certain public-sector decisions. A provider’s work on the underlying model wouldn’t by itself settle the obligations attached to deploying a system in one of those settings.

The Council account explicitly addresses general-purpose technology being integrated into a high-risk system and the allocation of roles along that chain. Its practical significance is that an organisation needs to identify both what it supplies and how it uses AI, rather than treating a model label as the whole compliance assessment.

This also connects to governance. The planned European AI Office would oversee the general-purpose model rules, while national authorities would supervise implementation at national level. A common technical foundation doesn’t erase the distinction between those responsibilities.

The compromise changes some negotiating positions

In June, Parliament backed its position for negotiations, including a proposed ban on live remote biometric identification in public spaces. December’s agreement describes narrow law-enforcement exceptions with safeguards, not the same blanket position.

Parliament says real-time identification would require prior judicial authorisation, be limited in time and location, and be tied to specified purposes, including searches for victims and prevention of a specific, present terrorist threat. These are proposed exceptions within a compromise, not an authorisation for any particular deployment today.

The Council also describes exclusions for exclusively military or defence uses, systems used solely for research and innovation, and non-professional personal use. Those purpose-based descriptions shouldn’t be expanded into a general exemption for a commercial product simply because research contributed to its development.

For businesses, the useful question is where an activity crosses from the stated exclusion into a regulated use. The final wording still needs to be completed; the press summaries aren’t a substitute for that text.

Preparation can begin before the legal timetable does

The proposed transition periods run from entry into force, not from the negotiating handshake. The Council describes a general two-year period with exceptions. A December 10 analysis identifies six months for prohibitions and a possible twelve-month start for some general-purpose obligations, while explicitly noting that details still require confirmation.

That isn’t a fixed calendar of compliance dates. Formal adoption and publication have yet to happen, and businesses shouldn’t turn a provisional interval into a claim that an obligation already applies.

An immediate, useful step is to map the models and systems an organisation develops or deploys, the purposes they serve and its role in each supply chain. That groundwork supports preparation without confusing the political agreement with the final law.