The EU’s Approach to AI Regulation in 2025: The Rule Stack, New 2025 Updates, and What Non-EU Businesses Must Do

By Yoel Molina, Esq., Owner and Operator of the Law Office of Yoel Molina, P.A.

The core pillars

• In force since Aug 1, 2024; staged application: prohibitions & AI-literacy since Feb 2, 2025; GPAI (general-purpose AI) obligations since Aug 2, 2025; most high-risk obligations apply Aug 2, 2026 (with embedded high-risk products allowed longer, to Aug 2, 2027). ( Digital Strategy)
• The Commission issued a GPAI Code of Practice (voluntary but Commission-backed) to help providers meet Articles 53–55 on transparency, copyright, safety, and security. ( European Commission)
• Draft GPAI guidelines clarify scope and obligations for model providers. ( Digital Strategy)

• The Data Act became applicable Sept 12, 2025, unlocking user/business access to IoT/connected-device data and smoother cloud switching—key for AI training/finetuning data pipelines. ( Digital Strategy)
• The DSA imposes risk-management and transparency duties on platforms (especially VLOPs/VLOSEs), including research data access—relevant if your AI distributes content at scale. ( Digital Strategy)

• Horizontal cybersecurity for software and connected products; entered into force Dec 10, 2024 and applies Dec 11, 2027. AI-enabled products with digital elements must meet secure-by-design obligations and handle vulnerability management. ( Digital Strategy)

• The new Product Liability Directive (PLD) broadens strict liability to digital/AI features; Member States must transpose by Dec 9, 2026 (application then). ( European Parliament)
• The separate AI Liability Directive proposal was withdrawn in Feb 2025; expect national tort rules + PLD to fill gaps. ( Hunton Andrews Kurth)

What changed in 2025 (that you’ll actually feel)

• GPAI obligations kicked in (Aug 2, 2025). Providers must deliver technical documentation, copyright-related disclosures, and—if “systemic risk” applies—robust safety/security measures. The GPAI Code of Practice offers a Commission-endorsed path to demonstrate compliance. ( Digital Strategy)

• Standards are accelerating. CEN/CENELEC fast-tracked delivery of priority AI Act harmonised standards in October 2025, a big step toward “presumption of conformity” for compliant products. ( cencenelec.eu)

• Data Act went live (Sept 12, 2025). Expect contract updates around data portability, B2B sharing, and cloud switching—these can materially affect AI training/finetune supply chains. ( Digital Strategy)

How the EU model works in practice

• Risk tiers drive obligations. “Unacceptable-risk” uses are banned; “high-risk” systems face conformity assessment, quality management, logging, transparency, human oversight; GPAI has its own track. ( Digital Strategy)

• Harmonised standards (CEN/CENELEC) will be the fastest way to prove conformity once published—build your QMS and technical docs to those drafts early. ( cencenelec.eu)

• Horizontal laws still apply: GDPR governs personal-data processing; DSA governs platform risks; the Data Act reshapes access/portability; CRA injects product cybersecurity; PLD toughens defect liability for digital/AI features. ( Digital Strategy)

If you’re a U.S. company, what do you need to do?

• Map your use case to AI Act risk tiers; if high-risk, plan for conformity assessment, logging, monitoring, and human-oversight controls. ( Digital Strategy)
• If you provide or integrate a GPAI model, prepare technical documentation, training-data summaries (copyright transparency), and risk-management files; consider signing onto the GPAI Code of Practice. ( Digital Strategy)
• Build toward harmonised standards—the October 2025 acceleration means drafts will harden quickly. ( cencenelec.eu)

• Align GDPR (lawful basis, DPIAs), and leverage Data Act rights (access/portability) in your contracts; plan for cloud switching and exit assistance to avoid lock-in. ( Digital Strategy)

• Start your CRA program now (SBOMs, vulnerability handling, secure development) so you’re ready by Dec 2027. ( Digital Strategy)
• Update product safety files for the new PLD exposure coming Dec 2026 (easier claimant proof, broader “defect” theories for software/AI). ( European Parliament)

A concise compliance checklist (build this this quarter)

• Assign owners: AI Compliance Lead + Privacy/Security Lead; define escalation to counsel.
• Risk mapping: Classify each AI use (unacceptable/high/limited/minimal) and whether GPAI is in scope. ( Digital Strategy)
• Documentation pack: Risk management file, data governance, logging, evaluation reports, human-oversight SOPs; create a technical file for market surveillance. ( Digital Strategy)
• Copyright transparency: Prepare training-data summaries and output-level safeguards consistent with the GPAI Code of Practice. ( Digital Strategy)
• Standards watch: Track CEN/CENELEC deliverables; align testing/metrics to draft harmonised standards for presumption of conformity. ( cencenelec.eu)
• Contracts: Add AI-Act compliance warranties, no-training-on-customer-data clauses, incident notice SLAs, cloud-switching support (Data Act), and product-cyber terms (CRA). ( Digital Strategy)
• Post-market monitoring: Define KPIs, complaint handling, and corrective action timelines for high-risk uses. ( Digital Strategy)
• Liability posture: Update insurance and internal approval thresholds in light of the new PLD timeline; monitor Member State transposition. ( European Parliament)

FAQs we hear from clients

Contact Us

For inquiries, please contact our Front Desk at fd@molawoffice.com or Admin at admin@molawoffice.com. You can also reach us by phone at +1 305-548-5020, option 1.

For traffic ticket assistance, visit molinatrafficticket.com.