A quiet but significant legal change took effect in August 2025. Under the EU AI Act, any company that modifies a general-purpose AI model intensively enough becomes, in the eyes of the law, that model's provider. That sounds technical. What it means in practice is this: instead of simply being a customer of AI, you become the regulated entity responsible for the model's compliance, transparency, and copyright practices.
The threshold for triggering this is measured in raw computing effort, specifically the number of mathematical operations performed during training. The EU set a default ceiling. If your fine-tuning run exceeds roughly one-third of the computing power it took to originally build the model, you have crossed the line. For most models, the original training figures were never published, so the EU established a default number: 3.3 times ten to the power of twenty-two operations. That is an enormous amount of computation. Most everyday fine-tuning sits well below it.
But this is not purely a technical story. It is a business governance story.
Companies in insurance, healthcare, retail, manufacturing, and financial services are increasingly fine-tuning AI models for internal use. They are doing it to build smarter document processors, customer service tools, compliance checkers, and pricing engines. Most of them have no idea this EU rule exists, and fewer still have any system to track whether their training activities cross the threshold.
If they do cross it, the obligations are substantial. They must produce detailed technical documentation of how the model was built. They must publish a summary of what data was used to train it. They must demonstrate compliance with EU copyright law. And from August 2026 onwards, the European AI Office gains full enforcement powers, including the ability to impose fines of up to 15 million euros or 3 percent of global annual revenue, whichever is higher.
The EU has also clarified that this law has no geographic boundary. A company based in South Korea, the United States, or Brazil that fine-tunes a model and makes it available to users in Europe falls within scope. The law follows the market, not the headquarters.
Amazon's move to embed compliance tracking directly into its cloud training platform is a telling signal. SageMaker now offers a tool that automatically measures the computing load of each training run, compares it against the relevant EU threshold, and produces an audit-ready document at the end. The whole thing is activated with a single line of configuration. That kind of tooling would not exist if large customers were not already asking for it.
There is a subtler point here worth noting. The EU guidelines acknowledge that the computing-based threshold is an indicative criterion, not the final word. Even if your training run stays below the ceiling, regulators could still scrutinise modifications that substantially change a model's behaviour or risk profile. The threshold is a safe harbour, not a blanket exemption.
For most non-technical businesses, the practical guidance is simpler than it might seem. Lightweight customisation methods, where only a small fraction of the model's parameters are updated rather than the entire model, consume dramatically less computing power. A company using this approach to fine-tune a mid-sized model on a few million words of internal documents will almost certainly remain well below the EU threshold. That is the approach most businesses should be using anyway, for cost reasons alone.
Where risk increases is when companies attempt full retraining of large models on very large proprietary datasets, or when they run many repeated training cycles. Those scenarios can accumulate computing load faster than expected, and without tracking, there is no way to know where you stand.
The compliance window is still open. Enforcement of fines specifically tied to GPAI obligations does not begin until August 2026. But documentation obligations have been active since August 2025, and models placed on the EU market from that date onward are expected to comply. Companies that start tracking now are building the paper trail that will matter when regulators begin asking questions.