General-Purpose AI Obligations Under the EU AI Act
The EU AI Act puts a separate set of rules on providers of general-purpose AI models - the foundation models behind most AI products. Most businesses meet this layer through a vendor, not directly. This page explains which side of that line you're on.
9+ Years of Compliance Expertise
End-to-End Execution
General-purpose AI (GPAI) models are regulated separately from the Act's main risk pyramid, under Title VIII (Articles 51-56). All GPAI providers must document their models, publish a training-content summary, and maintain a copyright-compliance policy - obligations that have applied since 2 August 2025. Models classed as carrying "systemic risk" face additional risk-assessment, incident-reporting, and cybersecurity duties. Most companies building products on top of a GPAI model are not themselves GPAI providers - but integrating one into a high-risk AI system can still trigger obligations of their own.
- What Counts as a "General-Purpose AI Model"The Act defines a GPAI model by capability, not by brand: a model showing significant generality, competent at a wide range of distinct tasks, regardless of how it's placed on the market. As a practical indicator, the Commission treats models trained with more than 10^25 FLOP of compute and at least a billion parameters as presumptively general-purpose — large generative language, image, and video models are the typical examples.
Which Side of the Line Are You On?
- You use a GPAI model through an APIYou call an existing model (like a major LLM) to build your own product without modifying it. The GPAI-specific obligations under Articles 53 and 55 sit with the model's provider, not you. Your own compliance comes from the Act's main risk-tier rules for whatever you build on top
- You modify or embed a GPAI modelYou substantially fine-tune a model, or integrate it into a high-risk AI system under Annex III or Annex I. This can trigger "provider" status of your own under Article 25 — you inherit the obligations attached to your finished system, even though you didn't build the underlying model. The original provider isn't automatically released either; who carries what should be set out contractually.
Provider Obligations
Baseline - all GPAI providers (Article 53)
In force since: 2 August 2025
Maintain up-to-date technical documentation, available to the AI Office, national authorities, and downstream providers - Publish a sufficiently detailed summary of training content - Maintain a policy to comply with EU copyright law, including machine-readable text-and-data-mining opt-outs
Note: genuine free/open-source models are exempt from documentation and training-summary duties - unless classed as systemic risk.
Maintain up-to-date technical documentation, available to the AI Office, national authorities, and downstream providers - Publish a sufficiently detailed summary of training content - Maintain a policy to comply with EU copyright law, including machine-readable text-and-data-mining opt-outs
Note: genuine free/open-source models are exempt from documentation and training-summary duties - unless classed as systemic risk.
Systemic risk - additional duties (Articles 51 & 55)
Trigger: training compute above 10^25 FLOP, or a Commission designation
- Assess and mitigate risks at EU level, including risks from development
- Run model evaluations, including adversarial testing
- Track, document, and report serious incidents
- Maintain adequate cybersecurity for the model and its infrastructure
- Notify the European Commission within two weeks of meeting the threshold
These duties can apply even before the model is placed on the market.
- Assess and mitigate risks at EU level, including risks from development
- Run model evaluations, including adversarial testing
- Track, document, and report serious incidents
- Maintain adequate cybersecurity for the model and its infrastructure
- Notify the European Commission within two weeks of meeting the threshold
These duties can apply even before the model is placed on the market.
Question 1 of 8
Check Your AI Compliance Score
- The GPAI Code of PracticeBecause Articles 53 and 55 leave technical detail to be worked out, the Commission facilitated a voluntary Code of Practice, developed with input from nearly a thousand stakeholders and assessed as adequate by the Commission in July 2025. Signing it isn't mandatory and doesn't create a legal presumption of compliance, but the AI Office can take adherence into account when assessing whether a provider has met its obligations — and a provider that doesn't sign it has to demonstrate its alternative approach is equally adequate.
What's Included
Determining whether your business is a GPAI provider, a downstream modifier, or simply a deployer of a product built on one
Reviewing vendor documentation and contracts to confirm where GPAI provider obligations sit in your supply chain
Assessing whether integrating a GPAI model into your product triggers Article 25 provider status
Building the compliance documentation your actual role requires
Frequently Asked Questions
Generally no. The GPAI-specific obligations under Articles 53 and 55 sit with the company that built and placed the model on the market. Using it through an API makes you a deployer of whatever you build on top of it, not a GPAI provider yourself.
It's a formal classification for the most capable GPAI models, triggered by a compute threshold (currently 10^25 FLOP) or a Commission designation. It brings extra obligations on top of the baseline GPAI duties, and applies to a small number of the most advanced models rather than to AI products generally.
No. It's voluntary, but non-signatories still have to meet the same underlying legal obligations under Articles 53 and 55 - they just have to demonstrate their own approach is adequate rather than pointing to the Code.
Yes, in specific circumstances - if you substantially modify the model or integrate it into a high-risk AI system, you can inherit provider obligations under Article 25 for the resulting system, separate from the underlying model's own GPAI obligations.
Related
Not sure whether you're a GPAI provider, a downstream modifier, or just a deployer?
By submitting this form, I acknowledge that I have read and agree to the Privacy Policy, and I consent to the processing of my personal data.
Please note: We do not provide any personalized investment advice, token selection guidance, or transaction recommendations. AMLzone is a compliance consultancy and project management services provider, not a Virtual Asset Advisor.
Please note: We do not provide any personalized investment advice, token selection guidance, or transaction recommendations. AMLzone is a compliance consultancy and project management services provider, not a Virtual Asset Advisor.