We use privacy-by-default, cookieless analytics.

Optional analytics cookies are used only if you accept them.

Read our Terms of Use and Privacy Policy.

FAQEU AI Act

EU AI Act What must general-purpose model providers do?

Providers of general-purpose AI () models have documentation, copyright and training-summary duties. Models with bring additional evaluation, risk-management, incident and security duties.

Check who provides the model, whether an open-source exception applies and whether the model has . The system built with it needs its own classification.

Back to main artifactReview sources
Author
Sorena AI
Published
May 9, 2026
Updated
Oct 21, 2026
5 sections8 primary sources
Overview

A general-purpose AI model can perform a wide range of tasks and be integrated into different systems. Chapter V regulates the provider placing that model on the EU market. Article 53 sets the baseline duties; Article 55 adds duties for models with . These model rules are separate from the risk classification of an AI system.

Search this module

Find a question or answer quickly

5 of 5 questions
Question 1

What does every covered model provider need?

Article 53 requires providers of general-purpose AI models to keep technical documentation for authorities, provide information to downstream AI system providers, maintain a copyright-compliance policy, and publish a sufficiently detailed summary of the content used for training.

The downstream information must help AI system providers understand the model's capabilities and limitations and comply with their own AI Act obligations, while protecting intellectual property, confidential business information, and trade secrets.

  • Keep model technical documentation up to date, including the training and testing process and evaluation results, for the AI Office and national competent authorities on request.
  • Provide integration documentation to downstream providers, including capabilities, limitations, acceptable use policies, release and distribution details, architecture, software dependencies, and other Annex XII information.
  • Put in place a policy to comply with Union copyright and related-rights law, including rights reservations under Article 4(3) of Directive (EU) 2019/790.
  • Publish the Article 53(1)(d) public summary of training content using the AI Office template.

What is a general-purpose AI model?

A general-purpose AI model is an AI model, including one trained with large amounts of data using self-supervision at scale, that has significant generality, can competently perform a wide range of distinct tasks, and can be integrated into many downstream systems or applications. The definition excludes models used for research, development, or prototyping before they are placed on the market.

Does Article 53 cover only systemic-risk models?

No. Article 53 is the baseline duty for providers of general-purpose AI models. Systemic-risk status adds Article 55 duties, but it does not supersede Article 53.

What information should system builders receive?

They should receive enough current documentation to understand the model's tasks, capabilities, limitations, acceptable use policies, release method, input and output modalities, relevant software, architecture, parameters, and integration constraints so they can meet their own AI Act obligations.

Question 2

When does a model have systemic risk?

A general-purpose AI model has under Article 51 if it has , or if the Commission designates it using Annex XIII criteria. The Commission may assess it on its own initiative or following a qualified scientific-panel alert.

Training compute above 10^25 floating point operations (FLOP) creates a presumption of . Notify the Commission without delay, within two weeks of meeting the condition or learning it will be met. The Commission can also designate a model using the separate Annex XIII route.

Assess EU-wide effects from the model's reach or . covers actual or reasonably foreseeable harm to health, safety, public security, fundamental rights or society that can spread across the value chain. Consider downstream use and misuse across sectors alongside benchmark results and direct applications.

  • Record the model's training compute estimate, methodology, and supporting evidence before market placement decisions.
  • Escalate if training compute exceeds 10^25 FLOP or if model reach, modalities, autonomy, scalability, tools, user base, or training data suggest Annex XIII significance.
  • If relying on the Article 52 exception argument, keep objective evidence for why the model does not present despite meeting the high-impact presumption.
  • Track Commission designation and reassessment decisions because systemic-risk status changes the provider duty set.

Is training compute the only systemic-risk test?

No. The 10^25 FLOP threshold creates a presumption of , but the Commission can also designate a model as based on Annex XIII criteria, including capability or impact considerations.

Can a provider challenge the classification?

Yes. Article 52 allows a provider that meets the high-impact condition to submit sufficiently substantiated arguments that, exceptionally, the model does not present due to its specific characteristics. A provider designated by Commission decision can also request reassessment with objective, detailed, and new reasons.

Question 3

What extra duties follow systemic-risk status?

Article 55 adds duties to Articles 53 and 54. Evaluate the model using state-of-the-art protocols and tools; conduct and document adversarial testing; assess and mitigate EU-level systemic risks; track and report serious incidents; and protect the model and its physical infrastructure against cyber threats.

Keep this work current during development, market placement and use. Include new incident and misuse evidence, corrective measures and security risks such as leaked or stolen models, unauthorised releases or access, and bypassed safety measures.

  • Model evaluation file: protocols, benchmarks or other methodologies, evaluation criteria, metrics, results, known limitations, and who performed the evaluation.
  • Adversarial testing file: internal or external testing plan, test scope, model adaptations, red-team findings, mitigation decisions, and unresolved risk rationale.
  • Systemic-risk file: Union-level risk sources, affected public interests, likelihood and severity, mitigation measures, residual risk, and post-market monitoring triggers.
  • Serious-incident file: incident facts, model version, affected use or integration, known or likely harm, corrective measures, reporting route to the AI Office and, where appropriate, national competent authorities.
  • Cybersecurity file: controls for weights, algorithms, servers, datasets, access management, physical security, leak prevention, vulnerability handling, and attack response.

Which serious incidents must model providers report?

Article 55 requires providers to keep track of, document, and report without undue delay relevant information about serious incidents and possible corrective measures to the AI Office and, as appropriate, national competent authorities. The Commission has published a template for serious incidents involving models with .

Does cybersecurity cover only the app or API?

No. Article 55 refers to cybersecurity protection for the model with and the physical infrastructure of the model. Recital 115 specifically points to model weights, algorithms, servers, datasets, operational security, cybersecurity policies, technical controls, and cyber and physical access controls.

Question 5

When do model duties and enforcement apply?

Chapter V duties apply from 2 August 2025. Commission enforcement powers, including Article 101 fines, apply from 2 August 2026. Providers of models placed on the market before 2 August 2025 must take the necessary compliance steps by 2 August 2027.

The cited Commission guidelines explain these dates and its enforcement approach. They are not legally binding; the Court of Justice of the European Union gives authoritative interpretations. Keep separate calendars for system-level, transparency, prohibited-practice, product-law and national-authority duties.

  • From 2 August 2025: Chapter V provider obligations enter into application according to the Commission guidelines.
  • From 2 August 2026: the Commission says its enforcement powers for provider obligations enter into application, including fines under Article 101.
  • By 2 August 2027: providers of models placed on the market before 2 August 2025 must take necessary steps to comply, according to the guidelines and Article 111(3) reference.
  • Do not use this FAQ to infer deadlines for unrelated high-risk AI system, prohibited-practice, transparency, product-law, or national-authority obligations.

Who enforces model-provider duties?

The Commission enforces compliance with model provider obligations, including through the AI Office, which monitors and supports compliance with general-purpose AI rules. The Commission guidelines also note that providers should cooperate with the AI Office and national competent authorities.

Are the Commission guidelines binding?

No. The guidelines state that they are not binding and that authoritative interpretation of the AI Act may only be given by the Court of Justice of the European Union. They still set out the Commission's interpretation and application approach for enforcement.

Get help

Check the records for each model

Sorena can help organise model documentation, information for system builders, copyright and training summaries, and additional systemic-risk records.

Research workflow
Research AI Act requirements

Check the legal sources and answers for your use case in Research Copilot.

Explore next step
Talk to Sorena
Review your implementation

Review your model documentation, downstream integration package, copyright policy, public training-content summary, and systemic-risk controls with Sorena.

Explore next step
Primary sources

References and citations

Regulation (EU) 2024/1689 (EU AI Act)
eur-lex.europa.eu6 citations
Referenced sections
  • Primary legal text for GPAI definitions, Article 51 classification, Article 52 procedure, Article 53 provider duties, Article 55 systemic-risk duties, Annex XI, Annex XII, and Annex XIII.
  • Primary legal text for Article 53 duties and Annex XI and XII documentation content.
  • Primary legal text for Article 51 classification, Article 52 notification and reassessment, and Annex XIII designation criteria.
Show 3 more
  • Primary legal text for Article 55 model evaluation, systemic-risk mitigation, serious-incident reporting, and cybersecurity duties.
  • Primary legal text for Article 53 copyright, training-summary, open-source exemption, and code-of-practice provisions.
  • Primary legal text for Article 101, Article 111, Article 113, and the underlying Chapter V obligations referenced by the Commission guidelines.
"GENERAL-PURPOSE AI MODELS"
More quoted passages
"Providers of general-purpose AI models shall"
"greater than 10^25"
"Obligations of providers of general-purpose AI models with systemic risk"
"summary about the content used for training"
European Commission - GPAI provider guidelines
digital-strategy.ec.europa.eu4 citations
Referenced sections
  • Commission guidance on GPAI provider scope, lifecycle obligations, downstream modifiers, open-source exemptions, systemic-risk classification, Code of Practice use, and staged enforcement.
  • Commission guidance on GPAI model provider scope, lifecycle documentation, downstream information, open-source exemptions, and staged application.
  • Commission guidance explaining GPAI scope, the systemic-risk presumption, notification to the AI Office, and training-compute estimation context.
Show 1 more
  • Commission guidance supporting the Chapter V application date, enforcement-power date, legacy-model compliance date, non-binding-guidance caveat, and Commission enforcement role.
"Guidelines for providers of general-purpose AI models"
More quoted passages
"scope of the obligations for providers of general-purpose AI models"
"trained with a cumulative amount of computational resources greater than 10^25"
"obligations enter into application on 2 August 2025"
European Commission - AI Act serious incident template
digital-strategy.ec.europa.eu2 citations
Referenced sections
  • Commission source for the serious-incident reporting template for GPAI models with systemic risk.
  • Commission page announcing the reporting template for serious incidents involving GPAI models with systemic risk.
"serious incidents involving general-purpose AI models with systemic risk"
More quoted passages
"reporting template for serious incidents"
European Commission - GPAI Code of Practice
digital-strategy.ec.europa.eu2 citations
Referenced sections
  • Commission page explaining the GPAI Code of Practice as a voluntary tool with Transparency, Copyright, and Safety and Security chapters.
  • Commission page explaining the GPAI Code of Practice chapters, including the Safety and Security chapter for Article 55 systemic-risk obligations.
"General-Purpose AI Code of Practice"
More quoted passages
"Safety and Security chapter"
European Commission - Training-content summary FAQ
digital-strategy.ec.europa.eu2 citations
Referenced sections
  • Commission FAQ supporting the mandatory template and common minimal baseline for GPAI training-content summaries.
  • Commission FAQ explaining that the template gives a common minimal baseline for public training-content summaries.
"common minimal baseline"
European Commission - Training-content summary template
digital-strategy.ec.europa.eu2 citations
Referenced sections
  • Commission source for the public summary of training content template under Article 53(1)(d).
  • Commission page for the explanatory notice and template for public summaries of training content under Article 53(1)(d).
"Public Summary of Training Content"
GPAI Code of Practice - Copyright Chapter
ec.europa.eu2 citations
Referenced sections
  • GPAI Code chapter used for copyright-policy implementation caveats under Article 53(1)(c).
  • Code chapter used for the caveat that adherence supports Article 53(1)(c) demonstration but does not itself determine Union copyright-law compliance.
"adherence to the Code does not constitute compliance"
Regulation (EU) 2026/1744, Article 1(21)
eur-lex.europa.eu
Referenced sections
  • Replaces Article 56(6) with Commission assessment and publication of code adequacy, removing the implementing-act approval mechanism.

Related guides

Are you the provider or the deployer? | EU AI Act

Check provider, deployer, importer and distributor roles, when changes create provider duties, and how model and system responsibilities differ.

Do you need a notified body? | EU AI Act

Find the assessment route for high-risk AI, when a notified body is required, and which declaration, CE-marking and registration records you need.

Does this tool count as AI? | EU AI Act

Check whether software counts as AI, how models differ from systems, when embedded AI is high-risk, and which scope and role evidence to keep.

How do you monitor AI after release? | EU AI Act

Understand high-risk AI monitoring under Article 72: the provider plan, deployer feedback, logs, corrective action, incidents and change reviews.

Is this industry use high-risk? | EU AI Act

See which industry AI uses fall under Annex III, when Article 6(3) can apply, and what providers must document and register.

What belongs in the technical file? | EU AI Act

See what Article 11 and Annex IV require in high-risk AI technical documentation, from system identity and testing to monitoring and retention.

Show all related guides (34)

When must you disclose AI use? | EU AI Act

Check AI interaction notices, technical content marking, biometric notices, deepfake and text disclosures, exceptions, accessibility and deadlines.

When must you report a serious incident? | EU AI Act

Check serious-incident outcomes, reporting roles, 15-, 10- and two-day deadlines, authority recipients, corrective action and the separate model route.

Who needs a rights impact assessment? | EU AI Act

Check who needs an Article 27 fundamental rights impact assessment, what it must cover, and how privacy assessments, notification and registration fit.

Common questions, clear answers | EU AI Act

Clear answers on AI Act scope, risk categories, provider and user duties, general-purpose models, disclosures, rights, assessments and deadlines.

EU AI Act deadlines and compliance calendar

Find the AI Act deadline for your system or model. Check high-risk dates, transparency duties, older-model transitions and the evidence to prepare.

EU AI Act fundamental rights impact assessments

Check who needs an Article 27 fundamental rights impact assessment, what it must contain and how DPIA reuse, notification and registration work.

EU AI Act GPAI model evidence checklist

Collect model documentation, integration information, copyright records and training summaries. Add testing, incident and security records for systemic risk.

EU AI Act monitoring and serious incidents

Set up high-risk AI monitoring, identify serious incidents and check reporting deadlines, recipients, deployer escalation and corrective action.

EU AI Act penalties and fines

Check the AI Act fine tiers, smaller-organisation caps, GPAI provider fines and the facts authorities consider when deciding a penalty.

EU AI Act serious incident reporting steps

Check serious-incident harm, preserve evidence and choose the reporting deadline and recipient for high-risk AI systems and systemic-risk GPAI models.

EU AI Act timeline and phased deadlines

See which AI Act rules apply now and what comes next. Check high-risk dates, older-model transitions and the difference between legal and standards dates.

EU AI Act vs ISO/IEC 42001

Compare AI Act legal duties with ISO/IEC 42001 management-system requirements. See which records can be reused and what certification does and does not cover.

EU AI Act vs NIST AI RMF

Compare AI Act legal duties with the voluntary NIST AI RMF. Map risk records to specific requirements and identify legal steps that need separate evidence.

EU AI Act: Check whether the Act applies

Use five checks to establish AI Act scope, exclusions, your role, risk categories and evidence for the decision.

EU AI Act: Choose a high-risk assessment route

Choose between provider-run internal control, notified-body assessment and a product-law procedure before release.

EU AI Act: Classify a tool before approval

Classify an AI tool or model before purchase or release. Check EU scope, prohibited uses, high-risk rules, transparency and GPAI duties.

EU AI Act: Compliance checklist

Check each AI tool, decide which duties apply, and give every action an owner and evidence link.

EU AI Act: Conformity assessment

Some high-risk systems use a provider-run assessment. Others need an authorised independent assessor or a product-law assessment.

EU AI Act: Does it apply to you?

Check whether the AI Act applies to your system or model, identify your provider or deployer role, and keep evidence for the decision.

EU AI Act: Duties for general-purpose AI models

Check GPAI provider duties for documentation, integrator information, copyright and training summaries, plus extra requirements for systemic-risk models.

EU AI Act: High-risk requirements

High-risk providers must meet system requirements before supply. Deployers must use and monitor the system under the provider's instructions.

EU AI Act: High-risk system checklist

Check the system's risk controls, data, documentation, logs, instructions, human oversight and testing before release.

EU AI Act: Is your use case high-risk?

Find high-risk AI examples in recruitment, banking, education, healthcare, public services and products. Check Article 6 conditions and exceptions.

EU AI Act: Plan your compliance work

Build a compliance plan for each AI tool: your role, the duties that apply, the evidence needed and the person responsible.

EU AI Act: Standards and quality management

Use EN 18286:2026 to organise provider quality-management procedures and keep evidence that they work for each high-risk system.

EU AI Act: Technical file and evidence templates

Build the technical file and provider records for a high-risk AI system, with owners and evidence links for each field.

EU AI Act: When must you disclose AI?

Check Article 50 chatbot notices, synthetic-output marking, biometric notices, deepfake disclosures and public-interest text exceptions.

EU AI Act: Which AI uses are banned?

Check Article 5 prohibited AI practices, the narrow exceptions, evidence to retain and the new content prohibitions from 2 December 2026.