Last updated: 10 November 2026
Quick answer: EU AI Act general-purpose AI model obligations have applied since 2 August 2025. Providers must keep technical documentation, inform downstream providers, adopt a copyright policy and publish a training content summary. Systemic-risk models face extra duties. The Commission has been able to fine since 2 August 2026; pre-August 2025 models must comply by 2 August 2027.
General-purpose AI (GPAI) models sit underneath thousands of products, from chat assistants to document review tools. The AI Act regulates them at the model level, separately from the AI systems built on top of them.
This guide explains who counts as a GPAI provider, what Articles 53 to 55 require, how the Code of Practice fits in, what changed in 2026, and what organisations that only use or fine-tune these models should do.
What are the EU AI Act general-purpose AI model obligations?
Chapter V of the AI Act (Regulation (EU) 2024/1689) sets two tiers of obligations: a baseline for every GPAI model provider (Article 53) and additional duties for models with systemic risk (Article 55).
Baseline duties for all GPAI providers (Article 53)
- Technical documentation: draw up and keep current documentation of the model, including training and testing processes and evaluation results, with at least the information in Annex XI, for the AI Office and national authorities on request.
- Downstream information: make information and documentation available to providers who integrate the model into their AI systems, covering at least the Annex XII elements, so they can understand its capabilities and limits and meet their own obligations.
- Copyright policy: put in place a policy to comply with EU copyright law, including identifying and respecting rights reservations (opt-outs) under Article 4(3) of Directive (EU) 2019/790.
- Training content summary: publish a sufficiently detailed summary of the content used for training, using the template provided by the AI Office.
Providers established outside the EU must appoint an authorised representative in the Union before placing a model on the EU market (Article 54).
Extra duties for systemic-risk models (Article 55)
- Perform model evaluations using standardised protocols and state-of-the-art tools, including adversarial testing.
- Assess and mitigate possible systemic risks at Union level.
- Track, document and report serious incidents and possible corrective measures to the AI Office and, where appropriate, national authorities without undue delay.
- Ensure an adequate level of cybersecurity protection for the model and its physical infrastructure.
Who counts as a GPAI model provider?
A provider is whoever develops a GPAI model, or has one developed, and places it on the EU market under its own name or trademark, whether paid or free. The obligations attach to the model, not to each product built on it.
The Commission’s guidelines for GPAI providers use training compute as the main indicator. A model trained with more than 10^23 floating-point operations that can generate language (text or audio), text-to-image or text-to-video is indicatively treated as general-purpose.
Companies that modify an existing model can become providers too, but only for significant modifications. The guidelines use an indicative threshold of more than one third of the original model’s training compute; below that, the modifier is generally not treated as the provider of a new GPAI model.
Common mistake: Assuming that fine-tuning an open model on internal data makes you a GPAI provider. In most cases it does not. You are more likely a deployer, or a provider of an AI system, with obligations that depend on the system’s use case rather than Chapter V.
When is a model presumed to have systemic risk?
Under Article 51(2), a model is presumed to have high-impact capabilities, and therefore systemic risk, when the cumulative compute used for training exceeds 10^25 floating-point operations. The Commission can also designate models on other criteria listed in Annex XIII.
Providers must notify the Commission within two weeks of meeting the threshold or of knowing it will be met (Article 52(1)). They can present arguments that, despite meeting the threshold, the model does not present systemic risk.
What about open-source models?
Models released under a free and open-source licence that allows access, use, modification and distribution, with their parameters, architecture and usage information made public, are exempt from the technical documentation and downstream information duties (Article 53(2)). They must still have a copyright policy and publish the training content summary. The exemption does not apply to models with systemic risk.
What is the timeline, and which deadlines have passed?
Most GPAI milestones are now behind us. The table summarises where things stand in November 2026.
| Date | Milestone | Status |
|---|---|---|
| 1 August 2024 | AI Act enters into force | Passed |
| 10 July 2025 | GPAI Code of Practice published | Passed |
| 2 August 2025 | Chapter V obligations apply to new GPAI models | Passed |
| 24 July 2026 | AI Omnibus published in the Official Journal (in force 27 July 2026) | Passed |
| 2 August 2026 | Commission enforcement powers, including fines, apply | Passed |
| 2 August 2027 | Deadline for models placed on the market before 2 August 2025 | Upcoming |
The Commission’s GPAI guidelines page confirms that from 2 August 2026 it can enforce compliance, including with fines. Under Article 101, fines for GPAI providers can reach 3% of total worldwide annual turnover or EUR 15 million, whichever is higher.
In practice: The two-year transition for “legacy” models is not a grace period for new versions. A new model released after 2 August 2025 is generally a new placement on the market, so it has had to comply from release.
How does the GPAI Code of Practice help?
The General-Purpose AI Code of Practice, published on 10 July 2025, is a voluntary tool that providers can use to demonstrate compliance with Articles 53 and 55 until harmonised standards exist (Article 53(4) and 55(2)). It has three chapters:
- Transparency: includes a Model Documentation Form covering the information providers must hold and share.
- Copyright: practical measures for a copyright policy and respecting machine-readable opt-outs.
- Safety and Security: risk management practices for systemic-risk models only.
According to the Commission, signatories include Amazon, Anthropic, Google, IBM, Microsoft, OpenAI and Mistral AI, while xAI signed only the Safety and Security chapter. Providers that do not sign must show compliance by other adequate means, which usually means more scrutiny from the AI Office.
The AI Office has also published a template for the public summary of training content, which providers use to meet Article 53(1)(d).
Did the 2026 AI Omnibus change GPAI obligations?
Not substantively. The AI Omnibus, Regulation (EU) 2026/1744, entered into force on 27 July 2026. Its headline change was deferring high-risk obligations to 2 December 2027 for stand-alone systems and 2 August 2028 for AI in regulated products.
For GPAI, the main effect is on supervision. The Omnibus strengthens the AI Office’s role over AI systems built on GPAI models where the model and the system come from the same provider or the same undertaking. Articles 53 to 55 and the Article 101 fines were not rewritten. Our earlier post on DORA, NIS2 and AI Act overlap explains how these rules sit alongside other EU regimes.
If you want one place to map AI Act duties, ISO 42001 controls and vendor evidence, you can start your 14-day free trial of Enactia.
What should organisations that use GPAI models do?
Most organisations are downstream: they buy API access, embed a model in a product, or fine-tune an open model. Chapter V puts the heavy lifting on the model provider, but downstream companies still have work to do.
A downstream GPAI checklist
- Inventory models in use: list every GPAI model behind your AI systems, the provider, version and how it is accessed.
- Collect provider documentation: request the Annex XII information and check the provider’s Code of Practice status and published training content summary.
- Classify your systems: decide whether each system is prohibited, high-risk, subject to Article 50 transparency, or minimal risk. Transparency obligations under Article 50 have applied since 2 August 2026.
- Check your modifications: record the compute used for fine-tuning so you can show you stay below the significant-modification threshold, or plan for provider duties if you exceed it.
- Update contracts: cover documentation access, incident notice, model change notices, copyright indemnities and EU representative details for non-EU providers.
- Assess the vendor: treat model providers like any other critical supplier, using your vendor and third-party risk process.
- Govern it: assign ownership, set an AI policy and log decisions through your risk management and policy management processes.
Provider vs downstream: who does what?
| Task | GPAI model provider | Downstream provider or deployer |
|---|---|---|
| Technical documentation (Annex XI) | Required (unless open-source exemption) | Not required; request what you need |
| Information for integrators (Annex XII) | Must supply | Should obtain and review |
| Copyright policy and training summary | Required | Check it exists |
| System risk classification | For its own systems | Required for each AI system |
| Article 50 transparency | If it provides the relevant system | Depends on role and system |
ISO/IEC 42001 gives a management system structure for all of this. Enactia’s ISO 42001 framework support and AI control mapping let you reuse one set of AI governance controls across the AI Act and other frameworks.
Key takeaways
- Articles 53 to 55 have applied to new GPAI models since 2 August 2025.
- Commission fines of up to 3% of worldwide turnover or EUR 15 million have been available since 2 August 2026.
- Models placed on the market before 2 August 2025 must comply by 2 August 2027.
- The 2026 AI Omnibus deferred high-risk rules but did not rewrite GPAI obligations.
- Most businesses are downstream: inventory models, collect documentation and manage providers as critical suppliers.
Frequently asked questions
When did GPAI obligations under the AI Act start to apply?
Chapter V obligations for general-purpose AI model providers have applied since 2 August 2025. The Commission’s enforcement powers, including fines, apply from 2 August 2026. Providers of models placed on the EU market before 2 August 2025 have until 2 August 2027 to bring those models into compliance.
What are the fines for GPAI model providers?
Under Article 101 of the AI Act, the Commission can fine GPAI model providers up to 3% of total worldwide annual turnover in the preceding financial year or EUR 15 million, whichever is higher. Fines can apply for infringing Chapter V obligations, failing to supply requested information or not complying with Commission measures.
Does fine-tuning a model make my company a GPAI provider?
Usually not. The Commission’s guidelines treat only significant modifications as creating a new GPAI provider, using an indicative threshold of more than one third of the original model’s training compute. Most fine-tuning falls well below that. You may still have obligations as a provider or deployer of the AI system you build.
Is signing the GPAI Code of Practice mandatory?
No. The Code of Practice is voluntary. Providers can rely on it to demonstrate compliance with Articles 53 and 55 until harmonised standards are published. Providers that do not sign must show compliance through other adequate means and should expect the AI Office to examine their approach more closely.
Are open-source GPAI models exempt?
Partly. Models released under a free and open-source licence with public parameters and architecture are exempt from the technical documentation and downstream information duties. They must still adopt a copyright policy and publish a training content summary. The exemption does not apply to models that present systemic risk.
Preparing for AI Office supervision
With fines now available and the 2027 legacy deadline approaching, GPAI compliance is an operational matter. Providers need documentation and copyright processes that stand up to AI Office requests; downstream organisations need an inventory, provider evidence and clear classification of their own systems.
Enactia’s AI-powered GRC platform connects AI Act requirements with ISO 42001, vendor risk and policies so you manage AI governance alongside privacy and security. To see how it would work for your organisation, contact us or book a demo or start your 14-day free trial.
This article is for general information and is not legal advice.
