GPAI Obligations Now Active: What Model Providers Must Know
August 2025 brought new obligations for General-Purpose AI models. Here's what the law requires, who must comply, and how the voluntary Code of Practice fits in.
GPAI Rules Are Now Active
As of August 2, 2025, providers of General-Purpose AI (GPAI) models must comply with new EU AI Act obligations. This milestone affects foundation model providers worldwide who serve the EU market.
What Qualifies as a GPAI Model?
Under Article 51, GPAI models are defined by their general capability and training compute. GPAI Models are AI models with significant generality that can perform a wide range of distinct tasks, trained using large-scale self-supervision on broad data. Systemic Risk GPAI are models meeting the cumulative compute threshold (currently presumed at 10^25 FLOPs) or designated based on capability assessments.
Core Obligations for All GPAI Providers
- Technical Documentation: Maintain and update comprehensive model documentation covering training, testing, and capabilities
- Training Data Summary: Publish a public summary using the EU's standardized template (published July 2025)
- Copyright Compliance: Respect EU Copyright Directive; implement processes to honor opt-out requests from rights holders
- Instructions for Use: Provide downstream users with clear usage guidance and capability descriptions
Additional Requirements for Systemic Risk Models
- Conduct and document adversarial testing ("red teaming") to identify systemic risks
- Assess and mitigate risks throughout the model lifecycle
- Report serious incidents to the AI Office within two weeks
- Implement robust cybersecurity protections against model compromise
- Notify the Commission within two weeks of meeting the systemic risk threshold
The Voluntary Code of Practice
The Commission published a voluntary GPAI Code of Practice in July 2025. While not legally mandatory, adherence provides a "presumption of compliance" with AI Act obligations—reducing regulatory burden and legal uncertainty.
Enforcement Timeline
- August 2, 2025: GPAI obligations take effect for new models
- August 2, 2026: EU Commission enforcement powers begin (fines, recalls, mandatory mitigations)
- August 2, 2027: Legacy models must fully comply
What This Means for Enterprises
For organizations deploying GPAI-based applications, understanding your provider's compliance posture is increasingly important. When evaluating AI vendors, consider asking: Have they published a training data summary? Do they follow the Code of Practice? How do they handle copyright compliance? These questions help assess regulatory risk in your AI supply chain.