EU AI Act (Regulation (EU) 2024/1689) GPAI obligations

Chapter V obligations apply from 2 August 2025. If a provider placed a GPAI model on the market before 2 August 2025, Article 111 gives that provider until 2 August 2027 to take the necessary steps to comply. The obligations still exist from 2 August 2025 for providers placing models on the market from that date onward.

The Commission guidance in the local source pack makes clear that the absence of immediate enforcement fines in the first year does not suspend the legal applicability of Chapter V.

Article 53 requires four pillars. First, technical documentation for the model and its training, testing, and evaluation process. Second, downstream information and documentation that lets AI system providers understand capabilities and limitations and comply with their own obligations. Third, a copyright policy that addresses Union copyright and related rights, including reservation of rights under the text and data mining rules. Fourth, a sufficiently detailed public summary of the content used for training, using the AI Office template.

These are living artifacts. They have to stay current as the model, training approach, or release strategy changes.

Article 53 contains a limited exception for providers releasing models under a free and open source licence where the parameters, architecture information, and model usage information are made publicly available. That exception does not apply to GPAI models with systemic risk.

Article 54 requires providers established outside the Union to appoint an authorised representative in the Union before placing a GPAI model on the Union market, unless the open source exception applies and the model does not present systemic risk.

A GPAI model is presumed to have high impact capabilities when the cumulative training compute exceeds the Article 51 threshold. Once that threshold is met or known to be met, the provider must notify the Commission without delay and in any event within two weeks. The Commission can also designate systemic risk on its own decision basis.

Systemic risk providers need stronger safety, security, and serious incident readiness under Article 55. The local source pack also includes the Commission reporting template and the code of practice materials that help structure this work.

Even if you are not the GPAI provider, you need upstream material that supports your own compliance. Integrators should not accept a black box relationship where capabilities, limitations, and incident obligations are unknown.

The downstream package should be usable by product, legal, security, and procurement teams, not only by machine learning engineers.