GPAI and Foundation Model Obligations Under the AI Act

Requirements for General-Purpose AI model providers

What Are GPAI Models?

General-Purpose AI (GPAI) models are AI models trained on broad data at scale that can be adapted to a wide range of tasks. This includes large language models (LLMs) like GPT-4, Claude, Gemini, and open-source models like Llama and Mistral. The AI Act introduced specific obligations for GPAI model providers starting August 2, 2025.

Standard GPAI Obligations

  • Prepare and maintain up-to-date technical documentation
  • Provide information and documentation to downstream providers integrating the model
  • Establish a copyright compliance policy, particularly regarding the Text and Data Mining opt-out
  • Publish a sufficiently detailed summary of the training data content

Systemic Risk GPAI Models

GPAI models that pose systemic risks (defined as those with high-impact capabilities, or models trained with more than 10^25 FLOPs of compute) face additional obligations:

  • Perform model evaluations including adversarial testing
  • Assess and mitigate possible systemic risks
  • Track, document, and report serious incidents
  • Ensure adequate cybersecurity protections

GPAI Code of Practice

The EU AI Office has published a voluntary GPAI Code of Practice that provides detailed guidance on meeting these obligations. Adhering to the Code provides a presumption of conformity with the AI Act's GPAI requirements. Major model providers have already become signatories.

Read our analysis of GPAI obligations →