GPAI Obligations Explained: What Providers Must Document
Last updated: 23 October 2026
Key takeaways
- The rules for general-purpose AI (GPAI) models have applied in the EU since 2 August 2025, and since 2 August 2026 the Commission can enforce them with fines of up to 3% of worldwide annual turnover or EUR 15 million whichever is higher.
- A company that builds on a model through an API, or fine-tunes it lightly, is usually not a GPAI provider.
- Providers need four documents: technical documentation for the regulator, information for downstream providers, a copyright policy and a public summary of training content.
- Open-source models are exempt from the first two documents, but not from the copyright policy and the training summary.
- A model trained with more than 10²⁵ FLOP is presumed to have systemic risk and carries extra obligations.
The rules for general-purpose AI models have applied in the EU since 2 August 2025, and since 2 August 2026 the European Commission can enforce them with fines. Read closely, almost all of these obligations come down to documents. The question for providers is not whether to document, but for whom. The AI Act names three audiences: the regulator, the businesses that build on your model and the public. Each gets a different document, with a different level of detail.
First, check that you are a provider
Not everyone who works with a large language model is a GPAI provider. The Commission’s guidelines use an indicative test: a model trained with more than 10²³ floating point operations (FLOP) that can generate language, text-to-image or text-to-video. The provider is whoever develops the model, or has it developed, and places it on the EU market. A company that modifies someone else’s model becomes a provider only if the modification uses more than a third of the compute originally used to train it.
This settles the question for most businesses. A company that builds a product on top of a model through an API, or fine-tunes it lightly, is usually not a GPAI provider. Its obligations come from other parts of the AI Act, depending on what its own AI system does.
Document 1: technical documentation for the regulator
Providers must draw up technical documentation of the model, including its training and testing process and the results of its evaluation, keep it up to date and hand it over to the AI Office or national authorities on request. Annex XI sets the minimum content:
- the tasks the model is designed for, acceptable use policies, release date and distribution methods;
- architecture and number of parameters, input and output formats, and the licence;
- design specifications of the model and the training process;
- information on the data used for training, testing and validation;
- the computing resources used for training and the known or estimated energy consumption.
This document is not published. But note the words “known or estimated”: the lack of exact energy metering is not a reason to leave the field empty.
Document 2: information for downstream providers
The second document is for the companies that integrate your model into their own AI systems. Annex XII adds several items to the list above: how the model interacts with hardware and software, the maximum input size such as the context window, and the type and origin of the training data and how it was curated. Providers may protect intellectual property and trade secrets, but must still give enough to let downstream providers understand the model and meet their own obligations.
This is the document your enterprise clients will ask for. A bank that builds a credit scoring tool on your model is running a high-risk AI system, and it cannot complete its own conformity assessment without this information.
Document 3: a copyright policy
Providers must have a policy to comply with EU copyright law. In particular, it must identify and respect rights holders who have opted out of text and data mining, including through state-of-the-art technologies. In practice, this means showing how your crawlers detect and follow machine-readable opt-outs, not just stating that you respect copyright.
Document 4: a public summary of training content
This is the only document of the four that everyone can read, so it is where rights holders and journalists will look first. It must follow the Commission’s template, which has three sections: general information, a list of data sources, and relevant aspects of data processing. For data scraped from the internet, providers list the top 10% of all scraped domains. Smaller companies can list the top 5% or 1,000 domains, whichever is lower. If the model is trained further, the summary must be updated every six months.
Open source: less paperwork, not none
Models released under a free and open-source licence, with their parameters, architecture and usage information made public, are exempt from the first two documents. The copyright policy and the training summary still apply, and the exemption disappears completely for models with systemic risk. The Commission also stresses that the licence must be truly open, without monetisation.
Systemic risk: a second layer
A model is presumed to have systemic risk if more than 10²⁵ FLOP were used to train it. The provider must notify the Commission within two weeks after the threshold is met or after it becomes known that it will be met. The second part matters: a provider planning a large training run may have to notify the Commission before training ends.
Such providers must also evaluate the model using state-of-the-art methods, including adversarial testing, assess and mitigate systemic risks, report serious incidents to the AI Office without undue delay and ensure adequate cybersecurity. The technical documentation grows accordingly: it must describe evaluation strategies and results, adversarial testing and, where relevant, the system architecture.
Providers outside the EU
A provider established outside the EU must appoint an authorised representative in the EU by written mandate before placing its model on the market. The representative must keep a copy of the technical documentation for ten years after the model is placed on the market. The open-source exemption applies here too, except for models with systemic risk.
The Code of Practice: evidence, not a shield
The General-Purpose AI Code of Practice, published on 10 July 2025, has three chapters: transparency, copyright, and safety and security. The transparency chapter includes a Model Documentation Form that covers most of what Annexes XI and XII require. Signing the Code helps a provider show compliance, but it does not create a presumption of conformity, and the Digital Omnibus of July 2026 confirmed that codes of practice do not grant one. Even for providers who do not sign, the form is a useful checklist.
Key dates
- 2 August 2025: obligations apply to new models.
- 2 August 2026: the Commission can impose fines of up to 3% of worldwide annual turnover or EUR 15 million, whichever is higher.
- 2 August 2027: deadline for models placed on the market before 2 August 2025.
What we recommend
- Check the compute used for each model, including fine-tuning, against the 10²³, one-third and 10²⁵ thresholds.
- Fill in the Model Documentation Form, even if you do not plan to sign the Code.
- Prepare a standard information pack for downstream providers before your enterprise clients ask for it.
- Document how your data collection respects text and data mining opt-outs.
The bottom line
GPAI obligations are less about what a model can do and more about whether its provider can explain it. A provider with complete documentation answers the regulator, its clients and rights holders from one source. If you are not sure whether your model is covered or what your documentation should contain, AMLzone can help you assess your position and prepare it.
Sources
1. Regulation (EU) 2024/1689 (AI Act), Art. 113(b) and Art. 101; European Commission, “Guidelines for providers of general-purpose AI models”. https://digital-strategy.ec.europa.eu/en/policies/guidelines-gpai-providers
2. European Commission, Guidelines on the scope of obligations for providers of general-purpose AI models under the AI Act, 18 July 2025, and the related Q&A. https://digital-strategy.ec.europa.eu/en/faqs/guidelines-obligations-gpai-providers
3. AI Act, Art. 53(1)(a) and Annex XI, Section 1. https://eur-lex.europa.eu/eli/reg/2024/1689/oj/eng
4. AI Act, Art. 53(1)(b) and Annex XII. https://eur-lex.europa.eu/eli/reg/2024/1689/oj/eng
5. AI Act, Art. 53(1)(c); Directive (EU) 2019/790, Art. 4(3). https://eur-lex.europa.eu/eli/reg/2024/1689/oj/eng
6. AI Act, Art. 53(1)(d); European Commission, Explanatory Notice and Template for the Public Summary of Training Content for general-purpose AI models, 24 July 2025. https://digital-strategy.ec.europa.eu/en/library/explanatory-notice-and-template-public-summary-training-content-general-purpose-ai-models
7. AI Act, Art. 53(2); European Commission, Q&A on the Guidelines for providers of general-purpose AI models. https://digital-strategy.ec.europa.eu/en/faqs/guidelines-obligations-gpai-providers
8. AI Act, Art. 51(2) and Art. 52(1). https://eur-lex.europa.eu/eli/reg/2024/1689/oj/eng
9. AI Act, Art. 55(1) and Annex XI, Section 2. https://eur-lex.europa.eu/eli/reg/2024/1689/oj/eng
10. AI Act, Art. 54. https://eur-lex.europa.eu/eli/reg/2024/1689/oj/eng
11. European Commission, “The General-Purpose AI Code of Practice”, 10 July 2025. https://digital-strategy.ec.europa.eu/en/policies/contents-code-gpai
12. European Commission, “General-Purpose AI Models in the AI Act – Questions & Answers”; Regulation (EU) 2026/1744, recital 41. https://digital-strategy.ec.europa.eu/en/faqs/general-purpose-ai-models-ai-act-questions-answers
13. AI Act, Art. 101(1), Art. 111(3) and Art. 113(b). https://eur-lex.europa.eu/eli/reg/2024/1689/oj/eng
27.10.2026
