GPAI obligations under the EU AI Act

The EU AI Act treats general-purpose AI (GPAI) models as a distinct regulatory object — separate from “AI systems” — with their own chapter (Chapter V, Articles 51–56) and their own timeline. GPAI provisions have been enforceable since 2 August 2025. This guide is what providers and deployers of GPAI need to know.

What counts as a GPAI model

Article 3(63) defines a GPAI model as one trained on a large amount of data using self-supervision at scale, capable of performing a wide range of tasks, and that can be integrated into a variety of downstream systems. The text was clearly written with foundation models (GPT-4, Claude, Gemini, Llama, Mistral) in mind.

The Act draws a line between GPAI models (the model itself) and GPAI systems (a product that incorporates the model — e.g., ChatGPT the chatbot). Different obligations apply to each.

Whether a model is a general-purpose AI model turns on its generality and its capability to perform a wide range of distinct tasks — there is no compute threshold for being GPAI. (The 10^25 FLOP figure below is a separate test, used only to presume systemic risk under Article 51.)

The two tiers of GPAI obligations

The Act creates two tiers based on whether the model is judged to have “systemic risk”:

| Tier | Threshold | Obligations | |---|---|---| | Standard GPAI | All GPAI models | Articles 53, 54 | | GPAI with systemic risk | Compute used for training exceeds 10^25 FLOPS, or designated by the Commission | Articles 53, 54, 55 |

Large frontier models may fall into the systemic-risk tier depending on training compute, capabilities, and Commission designation; smaller models generally sit in standard GPAI. Don’t assume a specific commercial model’s legal tier unless the provider or the Commission has published the basis.

Standard GPAI obligations (Article 53)

If you provide a GPAI model in the EU, you must:

1. Draw up and maintain technical documentation per Annex XI — covering training process, datasets, evaluation, compute usage, energy consumption, and architecture
2. Provide information to downstream providers so they can comply with their own obligations — per Annex XII
3. Put in place a policy to comply with EU copyright law, including respecting opt-outs expressed under Article 4(3) of the DSM Directive (2019/790)
4. Publish a sufficiently detailed summary of the training content — the now-famous “training data transparency” requirement

The training-content summary was the most controversial. The required level of detail is “sufficiently detailed” — vague — but a single page of generic categories is unlikely to satisfy a supervisory authority. The AI Office published guidance in late 2024 on a template format.

Systemic-risk GPAI obligations (Article 55)

If the model meets the systemic-risk threshold, additional obligations apply:

• Model evaluations including adversarial testing
• Assessment and mitigation of systemic risks at Union level
• Tracking and reporting of serious incidents
• Adequate cybersecurity for the model and its physical infrastructure

The AI Office has powers to designate any GPAI model as systemic-risk regardless of the FLOPS threshold (Art. 51(2)) — typically based on number of registered users, market impact, or potential for misuse.

Open-source carve-out (Article 53(2))

The Act includes a partial open-source carve-out. Providers of GPAI models released under a free and open-source licence — with weights, model architecture, and information about model use publicly available — are exempt from the technical documentation and downstream-information obligations, unless the model is classified as having systemic risk.

The carve-out does not exempt open-source GPAI providers from the copyright policy or training-content summary obligations. Those apply regardless.

What this means if you use a GPAI model

For the typical SaaS building on top of an existing GPAI (most readers of this guide):

• You are a downstream provider, not a GPAI provider. The GPAI provider (OpenAI, Anthropic, Mistral, etc.) owes Article 53. You owe whatever obligations attach to the AI system you build.
• Your vendor contracts should now reflect Article 53. Mistral, Anthropic, and OpenAI updated their developer terms in 2025 to pass through the relevant information you need to comply with your own obligations. If your DPA or master subscription agreement was signed before Q3 2025, refresh it.
• You inherit no GPAI obligations, but your downstream AI system can be high-risk (Annex III) even if the underlying model is generic. The classification follows the use case, not the model.

What this means if you fine-tune or modify a GPAI model

Recital 109 clarifies that modifying a GPAI model (fine-tuning, RLHF, etc.) can make you a GPAI provider yourself — but only if the modifications are substantial.

If you fine-tune a base model with a few thousand internal examples to specialise it on your domain, you are typically not a GPAI provider. Your system is still derived from the upstream GPAI, and the upstream provider’s documentation flows through.

If you fine-tune extensively, retrain large portions, or significantly alter the model’s capabilities — and place the result on the EU market — you may step into provider status. Document the decision and the boundary you drew.

Transparency under Article 50 — synthetic content labelling

Separate from Article 53, Article 50(2) requires providers of GPAI systems generating synthetic audio, image, video, or text content to mark the outputs in a machine-readable format detectable as artificially generated. The implementation is left to the provider — watermarking, metadata, or other technical signals — but the obligation is real and applies to chatbots, image generators, and voice synthesis tools used in the EU.

For deployers — the companies using synthetic content tools — Article 50(4) requires you to disclose that the content is AI-generated when it’s been published or otherwise disseminated. There’s an exemption for clearly artistic or satirical works (the Borat exemption), but the default is disclosure.

What you should be doing now

• If you provide a GPAI model: complete your Annex XI documentation, publish the training-content summary, update your downstream provider information per Annex XII, and confirm your copyright policy. Article 53 has been enforceable since August 2025.
• If you consume GPAI: confirm your vendor has the right documentation. Read their model cards. Document which GPAI model powers each AI feature of yours and what version you’re pinned to.
• If you fine-tune GPAI: write down your reasoning for whether you became a provider. This is the kind of judgement call a supervisory authority will probe later.

The GPAI chapter is the part of the AI Act most likely to keep evolving as the AI Office issues guidance. The 2 August 2025 deadline is past, but enforcement maturity is still building through 2026.