The EU Just Shipped a 70-Page Memo to Your CTO

I am writing this from a hotel back office in Lisbon, the kind with a printer that still prints fax cover sheets and a chef-owner who keeps asking me whether the EU is “really going to fine the bistro.” She is not the only one asking. Tomorrow, July 18, the European Commission is expected to publish its long-awaited Guidelines on General-Purpose AI providers — a document that has been in consultation since spring and which industry counsel have been frantically war-gaming for weeks. The contrarian take I want to put on the record before the PDF lands: the August 2 deadline is now real, and the line between “we just bought GPT-something” and “we are a deployer of a general-purpose AI system” is exactly where hospitality operators are going to get caught.

That sounds dramatic. It is not. It is logistics.

The shape of what drops tomorrow

Here is what is publicly knowable on the eve of release. The Commission has signalled the Guidelines will define a general-purpose AI model around the 10²³ FLOPs training-compute threshold — a number lifted from the AI Act’s recitals and translated, for the first time, into operational guidance. Models trained above 10²⁵ FLOPs fall into the systemic-risk tier with the heavier reporting, evaluation, and incident-disclosure obligations. The artificialintelligenceact.eu overview tracks this neatly: GPAI providers face transparency obligations on training data, downstream disclosure to integrators, and copyright-policy documentation. Providers of systemic-risk models pile on red-team obligations, cybersecurity baselines, and serious-incident reporting to the AI Office.

The August 2, 2025 commencement is the part the comms shops have been quietly burying in footnotes. As Nemko’s update walks through, the obligations on GPAI providers enter into force on August 2, with a generous grandfathering arrangement: models placed on the market before that date have until August 2, 2027 to come into compliance. New models — including any retrained, fine-tuned, or re-released after August 2 — get no such runway.

If you are a hotel group buying a customer-service co-pilot from a fast-moving vendor that ships a new model every six weeks, “grandfathered” is a comfort blanket you will not get to keep.

Why this hits hospitality differently

The Act is structurally about providers, deployers, importers, and distributors. Most operators reading this column assume they are deployers — they bought the thing, they switched it on, they collect tips on it. Tomorrow’s Guidelines are expected to muddy that assumption in two specific ways.

First, substantial modification. If you fine-tune a vendor’s base model on your own service-recovery transcripts, the Commission has been telegraphing for months that you may flip from deployer to provider of a downstream GPAI system. That is not an academic relabel. Provider obligations include transparency documentation, copyright policy disclosure, and — if you cross the systemic-risk threshold, which most operators will not but some platform-scale players might — eval and incident reporting. The line lives in the Guidelines’ modification clauses. Read them on Friday. Read them with your CTO.

Second, downstream disclosure. GPAI providers must furnish technical documentation to integrators. The Guidelines are expected to clarify what counts as “sufficient” — and integrators (you, the hospitality operator) will need to retain and act on it. If your vendor cannot produce a model card describing training data provenance, copyright-policy compliance, and known limitations, your AI Act paper trail has a hole in it that no amount of plausible deniability will fill.

I will mark my interpretation here: I think the Commission’s biggest tonal shift versus the consultation draft will be on open-weight models. There has been heavy lobbying from the open-source camp, and I expect the final text to carve more breathing room for non-commercial open weights than the spring draft did. That matters for hospitality because the cheapest path to a workable in-house assistant — a quantised open model fine-tuned on your booking logs — runs straight through that carve-out.

What operators should do between now and August 2

A short, unsentimental list. None of this is exotic.

1. Inventory your models. Every LLM, every vision model, every voice model in your stack. Vendor, version, last retraining date, where it sits on the 10²³ FLOPs question. Most off-the-shelf models from the big labs will be GPAI; many specialised vision and voice models will not. The Guidelines tomorrow will give you the test; apply it cell by cell.
2. Ask for model cards in writing. If your vendor cannot send you compliant documentation by July 25, they will not have it on August 2 either. That is your signal.
3. Map your fine-tunes. Any operator who fine-tuned on proprietary data this year needs a written assessment of whether the modification is “substantial.” Get counsel involved. The forthcoming May piece on the EU AI Act applied to restaurants (/blog/posts/the-eu-ai-act-is-already-live-for-your-restaurant-most-operators-dont-know-it) walks through the operator-level risk-class taxonomy and is the right companion read.
4. Decide your default. Many groups will conclude the cleanest answer is to stop fine-tuning on European customer data altogether and lean on retrieval-augmented setups. That is a defensible call. It is also the call most of the AI-native restaurant tech vendors I cover are quietly making — see the upcoming May piece on the Yelp AI stack (/blog/posts/desk-review-what-yelps-ai-stack-actually-does-for-restaurants) for how a platform of that scale is navigating the same trade-off.

The bit nobody wants to say out loud

The Guidelines tomorrow are not the end of regulatory uncertainty. The AI Office is still hiring. Codes of Practice are still being negotiated. National competent authorities have not all stood up. There will be enforcement asymmetries across member states for at least a year, and a lot of operators will rationally take the bet that the first dozen fines will land on frontier-model labs, not on a Lisbon bistro.

That bet is probably correct. It is also the wrong bet to organise your compliance posture around, because the August 2 obligations are not actually about fines. They are about paperwork your customers and your insurers and your acquirers will start asking for in six months. If you cannot answer “which GPAI models are in your stack and what documentation do you hold for each,” you will lose the deal — to a competitor who can.

Tomorrow’s PDF is not the regulation. The regulation has been law since 2024. Tomorrow’s PDF is the part where the Commission tells your CTO, in 70-odd pages, exactly which boxes to tick. Print it. Read it twice. Then schedule the August 2 stand-up.

— Hana edits the newsroom for TableTransfers. Tips: [email protected].