GPAI under the EU AI Act: obligations for model providers and what customers need to arrange

Alongside the risk classes for AI systems, the EU AI Act has a separate regime for general-purpose AI models, GPAI for short. These are the broadly usable models that chatbots, writing assistants and image generators run on. The obligations for providers of these models have applied since 2 August 2025, and since 2 August 2026 the European Commission can also enforce them. Most organizations do not build a model themselves, but they do use one, through an API or built into a SaaS product. For them the main questions are which role they have and what they can expect from their model provider.

What counts as a general-purpose AI model?

Article 3(63) describes a GPAI model as a model that displays significant generality, is capable of competently performing a wide range of distinct tasks and can be integrated into a variety of downstream systems or applications. Because that description is broad, the Commission's guidelines of July 2025 give an indicative criterion: a model trained with more than 10²³ floating-point operations (FLOP) that can generate language, as text or audio, or images and video from text. A large model that only masters one narrow task can fall outside the definition.

The distinction between model and system matters. The model is the building block. The system is the application the model runs in, with an interface and a purpose. The ordinary rules of the AI Act apply to that system, such as the transparency obligation of Article 50 or, for a use case listed in Annex III, the high-risk requirements. How that classification works is explained in the article on risk classification under the AI Act.

Provider of the model or of the system?

The GPAI obligations rest on the provider of the model: the party that develops the model, or has it developed, and places it on the EU market under its own name, whether paid or free of charge. An organization that uses a model through an API and builds its own chatbot on top does not become a GPAI provider. It is the provider of an AI system, in the regulation's terms a downstream provider, with the obligations that come with that system. Anyone who only uses an AI tool without building on it is a deployer.

There is one point where a customer can still become a GPAI provider. Under the guidelines, anyone who modifies an existing model, for example by training it further, becomes a provider if the modification uses at least one third of the compute of the original training. For a model without systemic risk the obligations are then limited to the modification. Working with your own documents through retrieval (RAG) does not change the model. Fine-tuning does, but usually takes a fraction of the original training compute. Record in your own documentation why you stay below the threshold.

The baseline obligations of Article 53

Article 53 places four duties on every GPAI provider. The first is technical documentation of the model, including the training and testing process and evaluation results (Annex XI), to be handed to the AI Office or the national authority on request. The second is information for downstream providers (Annex XII): what the model can and cannot do, so that whoever builds it in can meet their own obligations. The third is a policy to comply with EU copyright law, including respecting a reservation that rightsholders make against text and data mining. The fourth is a public, sufficiently detailed summary of the content used for training, following the template the Commission published in July 2025.

For models released under a free and open-source licence, with public parameters, the first two duties fall away. The copyright policy and the training summary still apply. The exemption does not apply to models with systemic risk, and under the guidelines it also does not apply if the model is monetised. Providers established outside the EU must also appoint an authorised representative in the Union (Article 54).

Models with systemic risk

A GPAI model has systemic risk if it has high-impact capabilities. That is presumed when training took more than 10²⁵ FLOP (Article 51). The Commission can also designate a model on other grounds. The provider must notify the Commission within two weeks once the threshold has been met or it becomes known that it will be met (Article 52). On top of Article 53, the duties of Article 55 then apply: model evaluations in line with the state of the art, including adversarial testing, assessing and mitigating systemic risks at Union level, reporting serious incidents to the AI Office and an adequate level of cybersecurity for the model and its physical infrastructure. This concerns a small number of providers of the most advanced models.

The GPAI Code of Practice

On 10 July 2025 the Commission published the General-Purpose AI Code of Practice, drawn up by independent experts. The Commission and the AI Board have assessed the code as an adequate voluntary tool. It has three chapters: transparency and copyright for all GPAI providers, and safety and security only for providers of models with systemic risk. Signatories can use the code to demonstrate compliance. The code is not a harmonised standard and therefore gives no automatic presumption of conformity. A provider that does not sign, or skips a chapter, has to show compliance in another way. xAI, for example, signed only the safety and security chapter. The list of signatories is on the Commission's website and is a first check for a customer.

Timeline and enforcement

The GPAI obligations have applied since 2 August 2025. Since 2 August 2026 the Commission can enforce them through the AI Office, including fines. Article 101 sets a maximum for GPAI providers of 3% of worldwide annual turnover or 15 million euros, whichever is higher. Models already on the market before 2 August 2025 must comply by 2 August 2027.

The Digital Omnibus (Regulation (EU) 2026/1744, in force since 27 July 2026) mainly moved the deadlines for high-risk AI. It did not substantially change the duties of GPAI providers. It did give the AI Office exclusive supervision of AI systems built on a GPAI model from the same provider or group. For generative systems placed on the market before 2 August 2026, the marking obligation of Article 50(2) applies from 2 December 2026. The shifted dates are covered in the article on the Digital Omnibus.

What this means if you build in or use GPAI

For most organizations the work lies on the customer side. Start with your role per use case. An internal writing assistant based on a public model makes you a deployer. A chatbot on your website under your own name makes you the provider of an AI system, with at least the transparency obligation of Article 50. If you use a model for an Annex III use case, such as selecting job applicants, the high-risk requirements apply to your system, regardless of what the model provider does.

Then look at the information from your supplier. Annex XII sets out what a model provider must give to downstream providers. Request that information, keep it with your own documentation and assess whether it is sufficient for your use case. Also check whether the provider has signed the Code of Practice and whether the training summary has been published.

Finally, do not forget the chain behind it. A SaaS product can use a third-party model without that being visible on the surface. Which tool runs on which model therefore belongs in your AI inventory.

GPAI in your AI management system

ISO/IEC 42001 does not mention GPAI, but the standard does give you the hooks to control model suppliers. Annex A.10.3 asks for a process to ensure that your use of services, tools and components from suppliers is aligned with your own approach, and A.10.2 for documented and allocated responsibilities in the AI system life cycle. An external model is also a resource you document under A.4. Dependence on a single model provider belongs in the risk assessment of clause 6.1.2: what happens if the provider changes the model, retires it or changes its terms? How the standard and the law fit together is explained in ISO 42001 and the EU AI Act.

An auditor testing an AI management system will ask, for a built-in GPAI model, for the supplier assessment, for the Annex XII information received or the reason it is missing, for the documented role per use case and for how model changes by the supplier end up in change management. You can take into account that the supplier has signed the Code of Practice; your own assessment is still needed. Support with setting this up is described on the compliance page.