The EU's AI Act includes restrictions for foundation models, subjecting some proprietary models classified as having “systemic risk” to additional obligations
Context & Ripple Effects
The Act began with a risk-based approach to AI uses, including the EU's earlier proposal to regulate high-risk AI applications. Negotiations later turned on whether foundation models should receive a carve-out, as France and Germany pressed for one.
This coverage shows the compromise extending the framework to general-purpose models while reserving extra scrutiny for a systemic-risk tier. The later issuance of compliance guidelines for systemic-risk models underscores that defining the rulebook would remain an implementation challenge.
First-order effects
- Providers of proprietary foundation models deemed to pose systemic risk face additional AI Act obligations, rather than being governed only through downstream high-risk uses.
- Foundation-model regulation becomes an explicit part of the Act’s risk-tier structure, putting the largest model providers directly in scope.
Second-order effects
- Affected providers must build compliance, documentation, and risk-management processes around the EU classification, increasing the operational importance of how a model is categorized.
- Companies deploying or integrating proprietary models gain a stronger incentive to assess whether their suppliers fall into the systemic-risk tier and can meet associated obligations.
Third-order effects
- The Act points toward governance that regulates general-purpose models as infrastructure with distinct risks, not solely the applications built on them.
- If other regimes follow this approach, frontier-model compliance may increasingly be shaped by threshold-based oversight of concentrated model capabilities, though the practical boundary depends on implementation guidance.
The trend: AI policy is moving from regulating specific high-risk uses toward direct oversight of the most consequential foundation models and their providers.