EU AI Act GPAI Obligations: What They Are and Whether They Apply to You

Answer first: if you use someone else's model — OpenAI's, Anthropic's, Mistral's, a Llama variant — you are almost certainly not a GPAI provider, and the four GPAI obligations are not yours. They belong to whoever placed the model on the EU market. Your obligations sit elsewhere in the Act, mostly in Article 50 transparency and, later, the high-risk rules. The confusion is understandable, and expensive: teams spend weeks preparing a training-data summary they were never required to publish, while skipping the disclosure duty that genuinely applies to them.

GPAI = General-Purpose AI: a model built to serve many downstream purposes rather than one specific task. This guide answers the question most articles on this keyword skip — am I a provider at all? — before it lists anything you have to do.

Standpoint is a self-assessment tool, and this article is general information, not legal advice. It tells you where you stand, not that you are compliant.

What are the GPAI obligations under the EU AI Act?

Providers of general-purpose AI models carry four core duties under Chapter V of the Act:

1. Technical documentation. Maintain and keep current documentation of the model, and make it available to downstream providers, and on request to the AI Office or a national competent authority.
2. A public training-data summary. Publish a "sufficiently detailed" summary of the content used to train the model, using the template issued by the AI Office. The template became mandatory and the duty took effect on 2 August 2025.
3. A copyright policy. Have a policy in place to comply with EU copyright law, including honouring text-and-data-mining reservations. One policy can cover multiple models.
4. Cooperation. Respond to information requests, and — for systemic-risk models only — notify the Commission.

Models designated as GPAI with systemic risk carry a heavier second tier: lifecycle risk assessment and mitigation, model evaluations, cybersecurity measures for the model and its weights, and serious-incident tracking and reporting.

Who counts as a GPAI provider?

A provider is the person or entity that develops a GPAI model — or has one developed for them — and places it on the EU market. Three consequences that catch people out:

• Commissioning doesn't shift the duty. If Entity B builds the model but Entity A puts it on the market, A is the provider.
• Hosting doesn't shift it either. Uploading model weights to a repository like Hugging Face doesn't make the repository the provider. The original developer remains it.
• "No EU office" is not a defence. If EU users can access the model, it has effectively been placed on the EU market.

Two quantitative thresholds define the category. The Commission's guidelines treat a model as GPAI when training compute exceeds 10²³ FLOPs (floating-point operations — the raw arithmetic used to train it) and it can generate language, image, or video outputs across a broad range of tasks. Specialised models above that compute level — transcription, image upscaling, weather forecasting — are excluded for lack of generality. A model presumed to carry systemic risk sits at 10²⁵ FLOPs or above, a hundred times higher.

For scale: a roughly 1-billion-parameter model trained on a substantial dataset typically clears the 10²³ threshold. That is not a frontier lab number. If you actually pre-train models, do the compute estimate — the guidelines require accuracy within ±30% with documented assumptions.

Does fine-tuning a model make me a GPAI provider?

Usually not. A downstream modifier becomes a provider in its own right only when the modification is significant, and the Commission sets an indicative threshold: the compute used for your modification exceeds one third of the compute used to train the original model (or one third of 10²³ FLOPs when the original figure isn't known). For a systemic-risk model, it's one third of 10²⁵ FLOPs.

Ordinary fine-tuning, LoRA adapters, instruction tuning on a few thousand examples, retrieval augmentation, and prompt engineering land nowhere near that. In practice, almost no company that isn't training foundation models will cross it.

And if you do cross it, the obligations are scoped to what you changed: documentation, training-data summary, and copyright policy covering your additional compute and data only — not the base model. The one exception is unforgiving: if you significantly modify a systemic-risk model, you inherit the full systemic-risk obligation set, including notifying the Commission.

Am I a GPAI provider or a deployer?

Run these in order:

1. Did you train or commission the model? No → you are not its provider. Stop here for GPAI purposes.
2. Did you fine-tune it using more than ~⅓ of the original training compute? Almost certainly no → still not a provider.
3. Do you integrate someone else's model into a product you put on the EU market? → You are a provider of an AI system (different obligations) and often a deployer. Article 50 transparency, AI literacy, and — from December 2027 — the high-risk regime are where your exposure lives.
4. Did you strip the "not for EU use" restriction off a non-EU model and bring it into the EU? → You may have become the provider by default.

Most SaaS companies stop at step 3. That is the single most useful sentence in this article, and it is the one the law-firm alerts on this topic don't lead with.

Are open-source models exempt from GPAI obligations?

Partially. Providers releasing a model under a genuinely free and open-source licence are exempt from supplying documentation to downstream providers and to authorities on request. They are not exempt from the training-data summary or the copyright policy. And a systemic-risk designation overrides the exemption entirely.

The licence has to be real: it must permit use, access, modification and redistribution, with no non-commercial or research-only restriction, no redistribution ban, no user-size threshold, and no mandatory commercial licence. Attribution and share-alike terms are fine.

Monetisation kills the exemption. Dual licensing (free for research, paid for commercial), paid support or updates as a condition of use, fee- or ad-supported hosted access, and processing user personal data in connection with access all count as monetisation. Optional premium support alongside genuinely free core access does not.

What changed on 2 August 2026 — and what didn't?

This is the most commonly misreported date in the category, so state it precisely:

• 2 August 2025 — GPAI obligations began to apply. They have been live for a year.
• 2 August 2026 — the Commission's enforcement powers switch on. From this date the AI Office can request information, order mitigations, require model recalls, and impose fines. National market surveillance authorities gain full investigation and sanction powers on the same date.
• 2 August 2027 — deadline for models already on the market before 2 August 2025 to come into compliance. Retraining or "unlearning" isn't required where technically or economically infeasible, provided that's justified in the documentation.

The Digital Omnibus on AI, Regulation (EU) 2026/1744, was published in the Official Journal on 24 July 2026 and entered into force on 27 July 2026. It delayed the high-risk regime (Annex III to 2 December 2027; Annex I to 2 August 2028) — it did not delay the GPAI enforcement date. It also gave the AI Office exclusive supervisory competence over AI systems built on a GPAI model by the same provider or group, which centralises GPAI oversight in Brussels rather than in 27 national regulators.

Penalties for GPAI-provider breaches reach €15 million or 3% of worldwide annual turnover, whichever is higher — except for qualifying SMEs, where Article 99(6) inverts it to the lower of the two, and for the newly defined small mid-caps (under 750 employees, turnover ≤ €150M or balance sheet ≤ €129M), which now get a capped tier of their own.

Does signing the GPAI Code of Practice make me compliant?

No. Signing is voluntary and the Code is not a harmonised standard, so it carries no automatic presumption of conformity. What it does offer: a structured way to demonstrate how you meet the obligations, potential mitigation in fine calculation, and less friction with the AI Office. Opting out of a chapter — transparency, copyright, or safety and security — means you cannot lean on the Code in that area, and non-signatories should expect to show their work through explicit gap analyses instead.

What should you actually do this quarter?

• Settle your role in writing. One paragraph, dated, stating whether you are a GPAI provider, an AI system provider, a deployer, or several at once — and why. This is the artifact every assessment asks for first and almost nobody has.
• If you fine-tune, record the compute. A one-line estimate of your modification compute against the base model's is the entire defence against accidentally becoming a provider.
• Inventory the models you consume, with vendor, version, licence, and whether the vendor publishes a training-data summary and copyright policy. That inventory is also the input to a vendor-risk review and to SOC 2 and ISO 42001 evidence.
• Fix Article 50 first. For most companies reading this, disclosure and marking obligations are the live exposure, and they apply from 2 August 2026 regardless of company size.

FAQ

Does the EU AI Act apply to my company if I only use ChatGPT internally?

Using a GPAI model internally makes you a deployer, not a provider. GPAI provider obligations don't apply. Article 4's AI-literacy duty does — softened by the Omnibus to "take measures to support the development of" literacy rather than guarantee a level — and Article 50 disclosure applies wherever your AI interacts with people or generates published content.

What is the difference between a GPAI model and a high-risk AI system?

Different axes. GPAI describes what the model is (general-purpose, above a compute threshold), and its obligations sit in Chapter V. High-risk describes what a system is used for (hiring, credit, education, critical infrastructure and the rest of Annex III). A GPAI model can power a high-risk system, and both sets of obligations then apply to their respective parties.

Do GPAI obligations apply to companies outside the EU?

Yes, if the model is placed on the EU market or its outputs are used in the EU. There is no headquarters exemption. The one carve-out: if a non-EU provider explicitly excludes EU use, the downstream actor who brings it into the EU becomes the provider.

Is the training-data summary the same as disclosing my training data?

No. It is a structured summary published from the AI Office's template — not a dataset dump. It's designed to let rightsholders and regulators understand what categories of content were used without exposing the corpus itself.

How do I know if my model has systemic risk?

Training compute at or above 10²⁵ FLOPs creates a presumption of it, and you must notify the Commission within two weeks of reaching — or reasonably foreseeing that you'll reach — that threshold. The Commission can also designate a model discretionarily. Presumptions can be rebutted with evidence, but obligations stay in force while the rebuttal is reviewed.