First wave of large-language-model liability and transparency rules produces enforceable disclosure and audit requirements in the European Union and at least one other major jurisdiction
Implementing acts and secondary legislation bring into force concrete disclosure, logging, and audit obligations for providers of general-purpose AI…
Grok · 2028 · plausible
Prior state
High-level risk classifications and transparency obligations existed on paper; detailed disclosure, logging, and third-party audit requirements for general-purpose models remained incomplete.
Material change
Implementing acts and secondary legislation bring into force concrete disclosure, logging, and audit obligations for providers of general-purpose AI models above defined capability thresholds, with first enforcement actions or compliance certifications appearing in 2028.
Why now
The statutory deadlines and delegated-act calendars fixed in the 2024 AI Act and subsequent 2025–2026 guidance place the first operational compliance window in 2027–2028.
Mechanism and resistance
Providers must publish technical documentation, maintain logs, and submit to conformity assessments. Resistance comes from competitive-secrecy concerns, measurement disagreements over capability thresholds, and extraterritorial application disputes.
Consequences
Model providers adjust release practices and documentation. Smaller open-weight developers face higher compliance costs. Downstream deployers gain clearer contractual baselines. Enforcement remains selective and capacity-constrained.
End state
Enforceable disclosure and audit rules are operational for general-purpose models in the EU and at least one additional major jurisdiction, with initial compliance filings or enforcement notices on record.
Observable test
Official registers or enforcement reports showing first-wave compliance certifications or sanctions under the new detailed obligations.
Disconfirming sign
Implementing acts are delayed and no enforceable detailed obligations are in force by end-2028.