What the EU AI Act means by it

The Act regulates two kinds of thing: AI systems, sorted by risk, and the general-purpose models many of those systems are built on. A general-purpose AI model (GPAI model) is defined in Article 3(63) by what it can do rather than how it was made: significant generality, and the ability to perform a wide range of distinct tasks competently. Large language models and the large image and video generators are the obvious cases.

The Commission's guidelines of July 2025 turn the definition into a working test. A model trained with more than 10^23 floating-point operations that can generate language (text or audio), text-to-image or text-to-video is indicatively a GPAI model. It is a presumption, not a bright line: a model above the threshold that only does one narrow task may fall outside, and the guidelines say so.

The two tiers of obligation

Every GPAI model provider must keep technical documentation for the AI Office and national authorities, give downstream providers the information they need to integrate the model and meet their own obligations, put in place a policy to comply with EU copyright law, and publish a sufficiently detailed summary of the content used for training (Article 53). Open-source models released with their weights are exempt from some of the documentation duties, unless they carry systemic risk.

A GPAI model with systemic risk is one with high-impact capabilities. It is presumed to have them when its cumulative training compute exceeds 10^25 floating-point operations (Article 51), and the Commission can designate a model on other grounds. Its provider must additionally evaluate the model, including adversarial testing, assess and mitigate systemic risks, track and report serious incidents to the AI Office, and ensure adequate cybersecurity (Article 55); see AI red teaming and AI incident.

These obligations have applied since 2 August 2025, and the Commission's powers to enforce them, including fines, since 2 August 2026. Models already on the market before 2 August 2025 have until 2 August 2027.

The Code of Practice

The General-Purpose AI Code of Practice, published on 10 July 2025, is the voluntary route to showing compliance. It has three chapters: transparency and copyright for every provider, and safety and security for providers of models with systemic risk. Most of the major model providers signed it; xAI signed only the safety and security chapter, and Meta did not sign. A provider that has not signed has to show compliance some other way, which in practice means more scrutiny from the AI Office.

How it differs from an AI system, a foundation model and a frontier model

  • An AI system is the product built around a model: the chatbot, the credit-scoring tool, the agent. A GPAI model becomes part of an AI system when someone builds one around it, and the system is then classified on its own terms, possibly as a high-risk AI system.
  • Foundation model is the older, informal term for roughly the same thing, and what most people mean by it is a GPAI model.
  • Frontier model is narrower and jurisdiction-specific. California's SB 53 and New York's RAISE Act define frontier models above 10^26 floating-point operations, a hundred times the EU's systemic-risk presumption.

Modifying a GPAI model can make the modifier its provider. The Commission's guidelines set the indicative test at a modification using more than a third of the original model's training compute, so most fine-tuning does not cross it; see provider and deployer.

What it means for an organisation that uses one

Most organisations are deployers of AI systems built on someone else's GPAI model, not GPAI providers, and the Act gives them a lever they did not have before. The provider is now obliged to hold documentation about the model and to give integrators what they need to comply. That is exactly what a vendor questionnaire should ask for: the technical documentation summary, the training content summary, the copyright policy, and for a systemic-risk model the evaluation and incident-handling approach. A provider that cannot produce them is telling you something, and the gap is inadequate AI vendor due diligence.

Frequently asked questions

What is a general-purpose AI model under the EU AI Act? A model that displays significant generality and can competently perform a wide range of distinct tasks. The Commission treats a model trained with more than 10^23 FLOP that can generate text, images or video as indicatively general-purpose.

What is a GPAI model with systemic risk? One with high-impact capabilities, presumed when cumulative training compute exceeds 10^25 FLOP or designated by the Commission. It carries extra duties: evaluation, adversarial testing, risk mitigation, incident reporting and cybersecurity.

When did the GPAI obligations apply? From 2 August 2025, with Commission enforcement from 2 August 2026 and until 2 August 2027 for models already on the market before August 2025.

Does fine-tuning a model make me its provider? Only if the modification is substantial. The Commission's indicative test is a modification using more than a third of the original training compute.

Where it sits in the register

Third-party model and dataset provenance and inadequate AI vendor due diligence are the register entries a deployer of a GPAI-based system carries, and third-party model and vendor due diligence is the control. The EU AI Act entry covers the Act as a whole.