Partnerblog
The Artificial Intelligence Act (AI Act), which entered into force on 1 August 2024, provides for a phased implementation of its obligations. The first phase, effective from 2 February 2025, focused on promoting AI literacy within organizations and prohibiting certain high-risk AI practices. Now, as of 2 August 2025, the second phase of the AI Act introduces obligations concerning penalties, general-purpose AI models (GPAI), and governance. The final phase will take effect in August 2026.
Penalties
As of 2 August 2025, the provisions on penalties and enforcement measures for infringements of the AI Act are applicable. The AI Act requires Member States to establish national rules on penalties, which may include administrative fines, warnings, and non-monetary measures. These penalties must be effective, proportionate, and dissuasive, while also taking into account the interests and economic viability of SMEs and start-ups.
The AI Act sets out (maximum) administrative fines depending on the nature of the infringement:
- Non-compliance with the prohibition on AI systems posing an unacceptable risk: up to 35.000.000 EUR or, for companies, 7% of total worldwide annual turnover, whichever is higher (for SMEs and start-ups, the lower amount applies);
- Non-compliance with certain obligations for providers, importers, distributors, or deployers of high-risk AI systems: up to 15.000.000 EUR or 3% of total worldwide annual turnover, whichever is higher (for SMEs and start-ups, the lower amount applies);
- Supplying incorrect, incomplete, or misleading information to notified bodies or national competent authorities: up to 7.500.000 EUR or 1% of total worldwide annual turnover, whichever is higher (for SMEs and start-ups, the lower amount applies).
When determining an administrative fine, the authorities must take into account all relevant circumstances. They may consider, among other things, the severity and duration of the infringement, the number of affected persons, the cooperation with the national competent authorities, and whether the infringement was intentional or negligent.
General-purpose AI models (GPAI)
Furthermore, as of 2 August 2025, specific obligations apply to providers of general-purpose AI models (GPAI). These models are trained on large datasets and are capable of performing a wide range of tasks. While they are not AI systems in themselves, they form the foundation for many downstream AI systems.
Providers of GPAI models must maintain technical documentation detailing the training and testing processes, as well as the results of evaluations. They must also ensure that up-to-date information is made available to downstream providers using the model, to help them understand its capabilities and limitations and comply with legal obligations.
For GPAI models that pose systemic risks, additional requirements apply. Providers must conduct regular evaluations to identify vulnerabilities and document incidents. They are also required to implement an adequate level of cybersecurity.
On 10 July 2025, the AI Office published a Code of Practice designed to help businesses comply with the obligations on GPAI. These obligations will become enforceable as of 2 August 2026 for new GPAI models, and as of 2 August 2027 for models placed on the market before 2 August 2025. This phased approach aims to ensure that GPAI models placed on the EU market are transparent and safe.
Governance
Finally, each Member State was required to appoint at least one notifying authority and one market surveillance authority by 2 August 2025. These bodies are respectively responsible for designating and informing independent conformity assessment bodies and for supervising AI systems. As of now, Belgium has not yet adopted legislation to further elaborate this oversight framework.
At the European level, supervision is coordinated by the AI Office and the European Artificial Intelligence Board (“AI-board”). Additionally, an Advisory Forum and a scientific panel of independent experts are being established.
Key takeaway
As of 2 August 2025, the second phase of obligations under the AI Act is in force. For businesses, the most relevant developments concern the penalty framework and the obligations for general-purpose AI models (GPAI).
At present, the Belgian legislator has not yet adopted national legislation to implement the enforcement and supervisory mechanisms, nor has it designated the required national competent authorities.
Authors
