Use this page to separate baseline Article 53 duties for general-purpose AI model providers from the extra Article 55 duties for models with systemic risk.
Covers technical documentation, downstream information, Union copyright policy, public training-content summaries, systemic-risk controls, serious-incident reporting, and Code of Practice caveats.
Structured answer sets in this page tree.
Cited legal and guidance references.
The AI Act uses the term general-purpose AI model, not foundation model, for models with significant generality that can be integrated into many downstream systems or applications. This page focuses on provider duties for those GPAI models: the baseline Article 53 duties that apply to GPAI model providers and the additional Article 55 duties that apply when a GPAI model is classified as having systemic risk.
Start with role and model classification. A provider is the organisation that develops a general-purpose AI model, or has one developed, and places it on the market under its own name or trademark. A deployer, downstream AI-system provider, reseller, or customer may have AI Act duties, but Article 53 and Article 55 are written for GPAI model providers.
Use foundation model as a search synonym only. The public compliance record should use the AI Act term general-purpose AI model, because the obligations and annexes are tied to that defined term.
Article 53 requires four core workstreams for providers of general-purpose AI models: model technical documentation for the AI Office and authorities, information for downstream AI-system providers, a Union copyright-law policy, and a public summary of training content using the AI Office template.
The documentation workstream is not just a model card. Annex XI points to model purpose, acceptable-use policies, release and distribution method, architecture, parameters, modality, licence, training and testing process, data provenance and curation, compute used for training, training time, and known or estimated energy consumption where relevant.
Article 53 has a limited open-source exception for the documentation and downstream-information duties in Article 53(1)(a) and (b). It applies only when the model is released under a free and open-source licence allowing access, use, modification, and distribution, and when parameters, weights, architecture information, and model-usage information are made publicly available.
That exception does not remove the copyright-policy duty or the public training-summary duty, and it does not apply to GPAI models with systemic risk. The Commission's GPAI provider guidelines also warn that significant modifications can make the modifier a provider for the relevant model changes, while minor changes are treated differently.
A GPAI model is classified as having systemic risk if it has high-impact capabilities evaluated with appropriate tools and methodologies, including indicators and benchmarks, or if the Commission designates it based on equivalent capabilities or impact. Article 51 creates a presumption of high-impact capabilities when training compute is greater than 10^25 floating point operations.
When the systemic-risk classification applies, Article 55 adds duties on top of Articles 53 and 54. The provider must evaluate the model, assess and mitigate Union-level systemic risks, track and report serious incidents without undue delay, and ensure an adequate level of cybersecurity protection for the model and its physical infrastructure.
The downstream package should let AI-system providers understand capabilities and limitations and meet their own AI Act duties. Annex XII requires more than marketing claims: it points to tasks, integration types, acceptable-use policies, release and distribution details, external hardware or software interactions, relevant software versions, architecture and parameters, input and output modality and format, licence, integration means, input and output limits, and training, testing, and validation data information where applicable.
The Transparency chapter of the GPAI Code of Practice adds a practical access pattern for signatories: disclose contact information for the AI Office and downstream providers, provide the most up-to-date model documentation intended for downstream providers, and provide necessary additional information within a reasonable timeframe, no later than 14 days after receiving the request except in exceptional circumstances.
The GPAI Code of Practice is voluntary. The Commission and AI Board have confirmed it as an adequate voluntary tool for GPAI model providers to demonstrate AI Act compliance, but Article 53 and Article 55 still allow other routes: harmonised standards grant presumption of conformity where they cover the obligations, and providers that do not adhere to an approved code or harmonised standard must demonstrate alternative adequate means of compliance for Commission assessment.
The Code should not be treated as a copyright safe harbour. Its Copyright chapter states that adherence to the Code does not constitute compliance with Union copyright law and does not affect copyright enforcement by Member State courts or the Court of Justice of the European Union.
No. The enforceable AI Act term for this page is general-purpose AI model. Foundation model may describe the same search intent in market language, but Article 53, Article 55, Annex XI, and Annex XII use general-purpose AI model.
Article 53 requires up-to-date model technical documentation, information for downstream AI-system providers, a Union copyright-law policy, a public training-content summary using the AI Office template, and cooperation with the Commission and national competent authorities.
Article 55 applies when a GPAI model is classified as having systemic risk under Article 51 and Article 52. The provider then has extra duties for model evaluation, adversarial testing, systemic-risk assessment and mitigation, serious-incident reporting, and cybersecurity protection.
Sorena can help convert GPAI model facts into an Article 53 documentation pack, downstream-provider information, copyright-policy evidence, public training-summary support, and systemic-risk controls where Article 55 applies.
Ask source-linked questions about GPAI model provider duties, systemic risk, documentation, copyright policy, and public training-content summaries.
Review whether your model evidence pack covers Article 53 baseline duties and Article 55 systemic-risk duties.
"voluntary tool"
"significant modifications to AI models"
"Model Documentation Form"
"Public Summary of Training Content"
"serious incidents involving general-purpose AI models"
"does not constitute compliance"
"Providing relevant information"
"alternative adequate means of compliance"