General-purpose AI (GPAI) obligations

Article 3(63) defines it as an AI model that displays significant generality, is capable of competently performing a wide range of distinct tasks regardless of how it is placed on the market, and can be integrated into a variety of downstream systems or applications. Models used for research, development or prototyping before being placed on the market are excluded. A large language model behind an API is the obvious case, but the definition turns on generality and integration, not on size or architecture.

A model is not a system. Article 3(66) defines a general-purpose AI system as an AI system based on such a model that can serve a variety of purposes, for direct use and for integration into other systems. Chapter V, Articles 51 to 56, governs models and their providers. A product built on top of a model is governed by the rest of the Regulation: Article 5, the high-risk rules where Annex III applies, and the transparency duties in Article 50.

Article 51(1) gives two paths: the model has high impact capabilities evaluated with appropriate technical tools, indicators and benchmarks, or the Commission decides, on its own initiative or after a qualified alert from the scientific panel, that it has equivalent capabilities or impact against the Annex XIII criteria. Article 51(2) adds a presumption of high impact capabilities where the cumulative computation used for training, measured in floating point operations, is greater than 10^25.

The presumption is rebuttable and the threshold is not fixed. A provider meeting the compute condition must notify the Commission without delay and within two weeks, and may argue in that notification that the model exceptionally presents no systemic risk (Article 52(1) and (2)). The Commission may also designate a model on its own initiative and publishes a list of models with systemic risk (Article 52(4) and (6)). Article 51(3) lets it amend the thresholds by delegated act.

Article 53(1) sets four duties. Keep up-to-date technical documentation of the model, its training and testing process and its evaluation results, containing at least the Annex XI information, for the AI Office and national authorities on request. Make information and documentation available to downstream providers integrating the model, covering at least the Annex XII elements, so they can understand its capabilities and limitations and meet their own obligations. Put in place a policy to comply with Union copyright law, including the rights reservation under Article 4(3) of Directive (EU) 2019/790.

The fourth duty is public: a sufficiently detailed summary of the content used for training, following the AI Office template, which the Commission issued as C(2025) 5235 final on 24 July 2025. Article 53(2) exempts free and open-source models with publicly available parameters, architecture and usage information from the documentation duties in points (a) and (b), but not from the copyright policy, not from the training-content summary, and not where the model carries systemic risk.

Article 55(1) adds four obligations on top of Articles 53 and 54. The provider performs model evaluation using state-of-the-art standardised protocols and tools, including documented adversarial testing, to identify and mitigate systemic risks. It assesses and mitigates possible systemic risks at Union level, including their sources. It tracks, documents and reports serious incidents and possible corrective measures to the AI Office without undue delay. And it ensures an adequate level of cybersecurity for the model and its physical infrastructure.

It is voluntary. The General-Purpose AI Code of Practice, published by the Commission on 10 July 2025, was drawn up in a multi-stakeholder process under Article 56. Providers may rely on a code of practice to demonstrate compliance with Article 53(1) and Article 55(1) until a harmonised standard is published (Articles 53(4) and 55(2)). A provider following neither an approved code nor a harmonised standard must demonstrate alternative adequate means of compliance for assessment by the Commission.

Two dates matter. Providers of models placed on the market before 2 August 2025 have until 2 August 2027 to bring them into compliance (Article 111(3)). And Article 113 excluded Article 101 from the 2 August 2025 start, so the Commission's power to fine model providers up to 15 million euro or 3 percent of annual total worldwide turnover applies from 2 August 2026, after preliminary findings and a hearing (Article 101(2)).

Almost certainly not as a provider. Articles 53 to 55 bind whoever places the model on the EU market, so a company calling a model through an API owes neither the training-content summary nor the copyright policy. Its duties sit elsewhere: AI literacy under Article 4, the prohibitions in Article 5, the deployer duties in Article 26 where the use is high-risk, and the disclosures in Article 50(3) and (4). Two situations move the line: under Article 3(3) you are the provider of an AI system you put into service under your own name, and under Article 25(1)(c) you become the provider of a high-risk system if you change a general-purpose system's intended purpose so that it becomes high-risk.