Obligations
General-purpose AI (GPAI): who is caught, and how
The Act has a distinct regime for large foundation models. Who qualifies as a GPAI provider, the compute thresholds, and an honest note on who this really affects.
Updated 3 July 2026 · Reference material, not legal advice
Large foundation models — general-purpose AI (GPAI) models — are governed by their own regime under Articles 51–55, in force since 2 August 2025. It is a subject that generates a lot of anxiety and, for most organisations, less obligation than they fear.
What counts as a GPAI model
The definition has two limbs: significant training compute (an indicative threshold around 10²³ FLOP) and genuine functional generality (language, text-to-image, text-to-video). A single-purpose model above the compute line — transcription, image upscaling, weather forecasting — is excluded: generality, not compute alone, is the gate.
A model is presumed to carry systemic risk when its training compute exceeds 10²⁵ FLOP, at which point the provider must notify the Commission within two weeks.
Obligations for all GPAI providers (Article 53)
- maintain technical documentation of the model;
- provide information to downstream providers integrating it;
- put in place a copyright policy aligned with EU law;
- publish a sufficiently detailed summary of the training data.
Models under a genuine free and open-source licence are exempt from the first two — but not from the copyright policy or the training-data summary, and never if they carry systemic risk. Systemic-risk models owe additional duties (Article 55): model evaluation and adversarial testing, systemic-risk mitigation, serious-incident reporting, and cybersecurity.
The honest part: who this really affects
Only a small number of providers worldwide currently exceed the systemic-risk threshold, and they are not the typical organisation deploying AI. If you build applications on top of a GPAI model, you are usually a downstream deployer, not a GPAI provider — your obligations flow from how you use the model, under the high-risk and transparency rules, not from the GPAI regime.
One exception worth knowing: if you fine-tune a model using a large share of the original training compute (an indicative one-third), you may become a GPAI provider for the scope of that modification.
What this means in practice
Euridium’s assessment includes a short GPAI-status branch, so a rare fine-tuner is caught — but you are not shown GPAI-provider duties that do not apply to you.
Run a guided assessment and get the obligations that apply to your role.
This guide is a plain-language summary for orientation. The authoritative text is Regulation (EU) 2024/1689 as published in the Official Journal of the European Union (12 July 2024). It does not constitute legal advice.