The day the model became somebody else's problem

The Record, written in October 2026. A retrospective. This piece covers August 2025, when the general-purpose AI obligations began to apply, and was written afterwards from the documents. Nothing here was published at the time.

On 2 August 2025 the AI Act reached the models. The obligations in Chapter V landed on providers of general-purpose AI systems: technical documentation, a policy on copyright, a summary of training content, and — for the largest models — additional duties around systemic risk.

For the companies building frontier models, that was the biggest day of the year. For a member association, it was the day a set of obligations moved upstream, away from them, and the day the paperwork they could demand from a supplier changed shape.

What moved upstream

Before August 2025, an association deploying an AI feature had to satisfy itself about the model underneath, because nobody else was obliged to. That is an impossible position for a buyer. You cannot audit a model you cannot see, built by a company that owes you nothing.

From August 2025, the provider of the model owes the documentation. The association does not need to obtain it directly in most cases — it needs to know that it exists, and to have a contract that says so. The practical change is one clause in a procurement document: evidence that the model provider has met its Chapter V obligations, and a commitment to tell the deployer when the model materially changes.

That last part is the one that matters and the one that was almost never asked for. A model that is silently upgraded underneath an association's renewals process is a process nobody has assessed. The Act does not make the association liable for the swap, but the association is still the one explaining it to a member.

What did not move

The deployer's own duties did not move an inch. Human oversight, use according to instructions, log retention, transparency to affected people. Those sat with the association before August 2025 and sat with it after.

This is where the press releases were misleading, and where a lot of budget was spent on the wrong thing. "The providers are now responsible" was read in some boardrooms as "we are now covered". The providers became responsible for the model. The association remained responsible for what it did with the model, to the people in front of it.

The procurement clause that should have changed

If I could have sent one paragraph to every association in August 2025, it would have been this: your supplier contract should now require the supplier to tell you what model it is using, whether that model is a general-purpose AI model under Chapter V, and what notice you will get before it changes.

Three questions. Almost none of the contracts I saw that autumn could answer any of them, because the contracts predated the question.

The quiet consequence

The general-purpose obligations created a category of supplier that can pass an audit and a category that cannot, and the difference is not visible in a demo. From August 2025, a serious supplier could hand over a documentation pack. A reseller wrapping somebody else's API could not.

That is not a compliance formality. It is the cleanest test available to a small organisation for whether it is buying from a company with an engineering function or from a company with a sales function. The Act made the test legible. Two years later, it is still the fastest question I know to ask a vendor: show me the model documentation you are required to hold.

The ones who can answer are the ones worth buying from, whatever their price.

---

The Record · ← AI literacy is an obligation, not a training course · The Omnibus nobody asked for →

---

Running an association? The AI Act for associations — what your body must actually do sets out the whole thing on one page: whether you are a provider or a deployer, the four duties that reach a membership body, the dates that matter, and the five items of evidence a board will ask for.