EU AI Act Duties for general-purpose AI models

A provider develops a general-purpose AI model, or has it developed, and places it on the market under its own name or trademark. A customer, reseller or application developer can have other duties without holding that role.

GPAI duties have applied since 2 August 2025; Commission enforcement powers apply from 2 August 2026. Models placed on the market before 2 August 2025 have a compliance transition to 2 August 2027. The 2026 amendment does not postpone these dates.

A non-EU provider must appoint an EU authorised representative by written mandate before EU market placement, unless the Article 54 qualifying open-source exception applies. That exception is unavailable for models with systemic risk.

The representative checks that Annex XI documentation exists, keeps a copy for 10 years after market placement, provides it to authorities on request and cooperates with them.

Providers need model technical documentation, information for application developers integrating the model, a copyright policy and a public training-content summary.

The technical file must go beyond a short model card. Annex XI covers purpose, use policies, release method, architecture, parameters, input and output types, licence, training/testing, data sources and preparation, compute, training time and known or estimated energy use where relevant.

The Article 53 open-source exception covers only technical documentation and integrator information. The licence must permit access, use, modification and distribution, and parameters, weights, architecture and usage information must be public.

Copyright policy and the public training summary remain required. Models with systemic risk cannot use this exception.

Commission guidance treats a modifier as a provider of the modified model when the change significantly affects generality, capabilities or systemic risk. Fine-tuning alone does not settle that question.

A GPAI model has systemic risk if it has high-impact capabilities assessed using appropriate tools, indicators and benchmarks, or the Commission designates it for equivalent capabilities or impact.

Article 51 presumes high-impact capabilities when training compute exceeds 10^25 floating-point operations. If that condition is met or you know it will be met, notify the Commission without delay and within two weeks.

Article 55 adds evaluations, EU-level risk assessment and mitigation, serious-incident tracking/reporting without undue delay, and adequate cybersecurity for the model and its physical infrastructure.

Annex XII information must help application providers understand the model's capabilities and limits and meet their own duties. Include tasks, integration options, use policies, distribution, software/hardware dependencies, versions, architecture, parameters, input/output formats and limits, licence and relevant training, testing and validation data.

For Code of Practice signatories, the Transparency chapter adds access commitments: provide contact details, current documentation for integrators and necessary additional information within a reasonable time. The deadline is no later than 14 days after a request, except in exceptional circumstances.

The GPAI Code of Practice is voluntary and has been assessed as adequate by the Commission and AI Board. Providers can use it to demonstrate compliance, or use other permitted routes.

Harmonised standards can provide a presumption of conformity for the obligations they cover. Providers using neither an assessed adequate code nor harmonised standards must demonstrate alternative adequate means for Commission assessment.

The Code is not a copyright safe harbour. Its Copyright chapter states that adherence does not establish compliance with EU copyright law or limit court enforcement.