General-Purpose AI (GPAI) Model Obligations Explained

The AI Act carves out a dedicated regime for general-purpose AI models - the foundation models and large language models that can be adapted to many downstream tasks.

Timeline at a glance

• 2 August 2025 - GPAI model obligations (Art. 51-56) apply to models placed on the market from this date.
• 2 August 2027 - GPAI models already on the market before 2 August 2025 must be brought into full compliance.
• Not affected by the Digital Omnibus (Regulation (EU) 2026/1744, in force 27 July 2026): the GPAI regime remains on its original schedule.

Baseline obligations for every GPAI provider

• Maintain technical documentation covering training, testing, and evaluation
• Provide information and documentation to downstream providers so they can comply with their own obligations
• Publish a sufficiently detailed summary of the training data
• Implement a policy to respect EU copyright law, including opt-outs under the DSM Directive

Additional obligations for models with systemic risk

Models above certain compute thresholds - or designated as posing systemic risk - must additionally:

• Perform model evaluations and adversarial testing
• Assess and mitigate systemic risks at Union level
• Report serious incidents and corrective measures to the AI Office
• Ensure an adequate level of cybersecurity

What downstream integrators should do

If you build on top of a GPAI model:

1. Demand the provider's Annex XI documentation - you need it to prove your own compliance.
2. Track the model's version and evaluation reports as part of your risk file.
3. Add a model-change monitoring process - a silent upgrade upstream can shift your risk classification.
4. Reflect these dependencies in your vendor contracts.

GPAI obligations are not optional and are not delayed. Ignoring them is the fastest way to have your product pulled from the EU market.