General-Purpose AI Models under the AI Act: Obligations, Systemic Risk and the Code of Practice

General-purpose AI models under the EU AI Act are AI models that display significant generality and can perform a wide range of distinct tasks; Chapter V places duties on their providers. Providers keep technical documentation, inform downstream providers, adopt a copyright policy and publish a training-content summary (Article 53), with open-source exceptions for the first two, and a model with systemic risk, presumed when its cumulative training compute is greater than 10^25 floating point operations (FLOP), brings four further duties (Article 55). The Commission alone supervises and enforces these duties, through the AI Office (Article 88(1)).

Three dates frame the model rules: Chapter V applies since 2 August 2025, Commission enforcement powers and fines since 2 August 2026, and models placed on the market before 2 August 2025 must comply by 2 August 2027. These rules sit in Chapter V of the EU AI Act, Regulation (EU) 2024/1689, in force since 1 August 2024 and amended by Regulation (EU) 2026/1744 of 8 July 2026 (the Digital Omnibus on AI), in force since 27 July 2026. That amendment moved none of the three dates and left Articles 51 to 55 unchanged.

Compiled by the AIActGuide.net Editorial Team from the Official Journal text; how we check every statement: methodology.

What Is a General-Purpose AI Model?

A general-purpose AI model is an AI model that displays significant generality, competently performs a wide range of distinct tasks and can be integrated into a variety of downstream systems or applications (Article 3(63)). Article 3(63) is one of the AI Act definitions that also cover the general-purpose AI system (Article 3(66)) and the downstream provider (Article 3(68)).

The Article 3(63) Definition and the Research Carve-Out

Article 3(63) defines the model by four elements and excludes models used for research, development or prototyping before they are placed on the market. The full text reads:

"an AI model, including where such an AI model is trained with a large amount of data using self-supervision at scale, that displays significant generality and is capable of competently performing a wide range of distinct tasks regardless of the way the model is placed on the market and that can be integrated into a variety of downstream systems or applications, except AI models that are used for research, development or prototyping activities before they are placed on the market"

The four cumulative elements of the definition are:

• Significant generality, which self-supervised training at scale can indicate.
• Competence across a wide range of distinct tasks, not one narrow task.
• Independence from the distribution channel: the way the model is placed on the market does not matter.
• Integrability into a variety of downstream systems or applications.

The carve-out ends when the model is placed on the market. Recital 109 adds that persons who develop or use models for non-professional or scientific research purposes need not comply.

Indicators of Generality: One Billion Parameters and 10^23 FLOP

Two indicators signal generality: recital 98 points to at least a billion parameters, and the Commission guidelines use training compute greater than 10^23 FLOP combined with language, text-to-image or text-to-video generation.

The recital guides interpretation but does not bind on its own. The 10^23 FLOP criterion comes from Communication C(2025) 7719 final of 19 November 2025, never from the act, and paragraph 18 explains that it approximates the compute needed to train a one-billion-parameter model on a large amount of data. The guidelines are non-binding, and the Commission's Q&A on the guidelines states: "An authoritative interpretation of the AI Act may only be given by the Court of Justice of the European Union."

Model versus System: Where the Model Ends

A model is not yet an AI system: recital 97 states that models "require the addition of further components, such as for example a user interface, to become AI systems". The distinction decides which chapter applies, because Chapter V regulates the model while the rest of the act regulates the systems built from it. A chatbot, an assistant or a coding tool that integrates a model is a general-purpose AI system under Article 3(66) when it can serve a variety of purposes.

The GPAI Section of This Guide: Ten Pages and What Each Answers

Ten pages of this guide go deeper into Chapter V: duties, systemic risk, the Code and its signatories, the training-content summary, copyright, the guidelines, downstream providers, documentation and supervision.

The pages follow the order of the chapter: classification in Articles 51 and 52, duties in Articles 53 to 55, codes in Article 56, then enforcement in Chapter IX, Section 5.

Two Tiers of Duties: The Decision Logic for Model Providers

Four questions decide which Chapter V duties apply: whether the model is a general-purpose AI model, who its provider is, whether it has systemic risk, and whether it is released under a free and open-source licence. The answers give an orientation, not a legal assessment.

Who Counts as the Provider of a GPAI Model

The provider of a general-purpose AI model is whoever develops it, or has it developed, and places it on the market under its own name or trademark, whether for payment or free of charge (Article 3(3)). The duties apply irrespective of whether the provider is established in the Union or in a third country (Article 2(1), point (a)). The same role test runs through the whole act, and the guide to provider vs deployer roles explains how it applies to AI systems as well.

The Commission guidelines C(2025) 7719 list ways of placing a model on the market, such as a software library, an API, a public repository, a cloud service, a chatbot web interface or a mobile app. When a model supplied outside the Union is integrated into a system placed on the Union market, the upstream developer remains the provider unless it excluded Union distribution and use "in a clear and unequivocal way". In the Commission's reading, a downstream modifier becomes the provider of the modified model when the modification uses more than one third of the original training compute, and its duties then cover only the modification (guidelines, section on downstream modifiers).

The 10^25 FLOP Presumption and Commission Designation

A general-purpose AI model is classified as a model with systemic risk when it has high-impact capabilities or the Commission designates it, and it is presumed to have them when its cumulative training compute is greater than 10^25 floating point operations (Article 51). The provider notifies the Commission without delay and at the latest within two weeks after the threshold is met or it becomes known that it will be met (Article 52(1)). The Commission can designate a model ex officio or after a qualified alert from the scientific panel of independent experts, using the Annex XIII criteria, and a designated provider may request reassessment at the earliest six months after the decision (Article 52(4) and (5)). The Commission factpage on general-purpose AI obligations (last updated 1 August 2025) says of the threshold: "This threshold is currently under review." Article 51(3) empowers the Commission to amend it by delegated act, and the Commission's Q&A on general-purpose AI models says that models with systemic risk are currently developed by "a handful of companies".

Open-Source Models: Which Duties Fall Away and Which Stay

A model released under a free and open-source licence with public parameters, weights, architecture and usage information is excepted only from Article 53(1)(a) and (b) and Article 54, and never when it has systemic risk. The copyright policy of Article 53(1)(c) and the training-content summary of Article 53(1)(d) always apply, as paragraphs 70 and 72 of the guidelines confirm. Licence conditions and monetisation can remove the exception, which the guide to open-source AI under the AI Act examines for models and systems alike.

Duties at a Glance: Articles 53 to 55 by Type of Model

Every provider of a general-purpose AI model adopts a copyright policy and publishes a training-content summary, all but open-source providers also keep technical documentation and inform downstream providers, and providers of models with systemic risk add four further duties.

Codes of practice can be relied on until a harmonised standard is published; harmonised standards give a presumption of conformity; otherwise providers show alternative adequate means (Articles 53(4) and 55(2)).

The duties scale with the provider: recital 109 foresees simplified ways of compliance for SMEs, including start-ups. Every provider also cooperates with the Commission and national competent authorities (Article 53(3)). Duties of AI systems built on a model come on top, and the EU AI Act checklist sorts obligations by role and risk class.

Providers established in third countries appoint an authorised representative in the Union by written mandate before placing a model on the Union market, and the representative keeps the Annex XI documentation for 10 years (Article 54).

The Code of Practice: A Voluntary Way to Demonstrate Compliance

The General-Purpose AI Code of Practice, published on 10 July 2025, is a voluntary tool with three chapters (Transparency, Copyright, Safety and Security) that providers can use to demonstrate compliance with Articles 53 and 55, without a presumption of conformity. The Transparency and Copyright chapters address all providers, and the Safety and Security chapter, with 10 commitments covering four specified risks (chemical, biological, radiological and nuclear risks, loss of control, cyber offence and harmful manipulation), addresses providers of models with systemic risk.

Since 27 July 2026, the Commission, taking utmost account of the opinion of the AI Board, assesses whether codes cover Articles 53 and 55 and publishes its assessment (Article 56(6) as replaced by Regulation (EU) 2026/1744, Article 1, point (21)). Before 27 July 2026, the AI Office and the Board assessed codes, and the Commission could approve a code by implementing act. The Commission found the Code adequate in Opinion C(2025) 5361 final of 1 August 2025.

The Commission list shows 22 full signatories plus xAI, which signed the Safety and Security chapter only (page last updated 7 October 2026, checked 24 October 2026). The Commission adds: "Some signatories may not appear immediately, but we are making sure to continuously update the list as signatures are confirmed." The chapters of 10 July 2025 remain the current version, and the Commission's Q&A on signing the Code states that it is reviewed at least every two years.

A second, separate code exists under Article 50(7): the Code of Practice on Transparency of AI-Generated Content, final since 10 June 2026, covers marking and labelling by AI systems, not model duties.

Key Dates for Model Providers: 2025, 2026 and 2027

Model providers work to three application dates: the start of Chapter V, the start of Commission enforcement and fines, and the end of the transition for models already on the market.

The Commission's Q&A on the Code of Practice described the first year from 2 August 2025 as a period in which incomplete implementation was treated as good faith, with full enforcement and fines from 2 August 2026; that period has ended.

Models already on the market before 2 August 2025 have a two-year transition. The EU AI Act timeline lists every other application date of the act. For these legacy models, paragraph 108 of the guidelines states that retraining or unlearning is not required where it is impossible or disproportionate, provided the provider discloses and justifies this in its copyright policy and training-content summary.

Commission Supervision, Fines and the Status on 24 October 2026

The Commission has exclusive powers to supervise and enforce the obligations of general-purpose AI model providers, entrusted to the AI Office (Article 88(1)), and national authorities have no competence over these providers. The AI Office is a Commission function (Article 3(47)), set up by Commission Decision C(2024) 390 of 24 January 2024, and not an EU agency.

National market surveillance authorities supervise AI systems built on a third party's model, while the AI Office supervises systems built on a model of the same provider or undertaking (Article 75(1) as replaced by Regulation (EU) 2026/1744). Market surveillance authorities may ask the Commission to use its powers where necessary and proportionate for their tasks (Article 88(2)), and the AI Office supplies model information an authority requests within 30 days (Article 75(3)).

The Commission can fine a provider that, intentionally or negligently, infringes the act, fails to comply with a request for information or supplies incorrect, incomplete or misleading information, disregards a measure or refuses access for an evaluation (Article 101(1), points (a) to (d)). The SME rule of Article 99(6) does not apply to these fines, and the Court of Justice has unlimited jurisdiction to cancel, reduce or increase them (Article 101(5)). Article 101 is the only AI Act fine the Commission imposes directly, while the guide to EU AI Act penalties covers the Article 99 maxima that national penalty rules lay down and the Article 100 fines for Union institutions.

Implementing Regulation (EU) 2026/1755, adopted on 20 July 2026 and published in OJ L, 2026/1755, 21.7.2026, was adopted under Articles 92(6) and 101(6) and entered into force on 10 August 2026. It gives providers no less than 21 days to reply to preliminary findings (Article 7(2)).

On 14 October 2026, Executive Vice-President Virkkunen stated (SPEECH/26/2150): "Since 2 August enforcement powers have applied, and the Commission has already taken our first enforcement actions under the AI Act." The same speech says the AI Office "sent Requests for Information addressing issues such as security, external evaluation and monitoring how models are used". The AI Act Service Desk FAQ calls technical compliance dialogues "a first tool of choice", with enforcement powers used where dialogues are not sufficient.

From Model to AI System: Downstream Integration, High-Risk Use and Article 50

Chapter V regulates the model; the AI systems built on it carry their own duties under the rest of the act. An integrator takes on the system duties of its risk class.

Downstream Providers and the Information Duty in Article 53(1)(b)

A downstream provider is a provider of an AI system that integrates an AI model, whether its own or another entity's (Article 3(68)), and the model provider must give it the Annex XII information. The act sets no deadline for that information, while Measure 1.2 of the Code's Transparency chapter commits signatories to answer within 14 days, save in exceptional circumstances. A downstream provider can complain to the AI Office under Article 89(2), through the channel EU-AIOFFICE-DOWNSTREAM-PROVIDER-COMPLAINTS@ec.europa.eu with a signed template; anonymous complaints are not accepted.

When a System Built on a GPAI Model Is High-Risk or Subject to Article 50

The high-risk rules classify AI systems, not models, so a system built on a general-purpose AI model is high-risk when it meets Article 6. Illustration (our reading): a recruitment tool built on a model can fall under Annex III, point 4(a), and the Chapter III, Sections 1 to 3 rules for high-risk AI systems then apply to that system from 2 December 2027 (Article 113, third paragraph, point (c)(i)).

Under Article 25(1), point (c), a distributor, importer, deployer or other third party that modifies the intended purpose of a general-purpose AI system not classified as high-risk so that it becomes high-risk is considered a provider of a high-risk AI system. Where market surveillance authorities have sufficient reason to consider a general-purpose AI system that deployers can use directly for at least one high-risk purpose non-compliant, they cooperate with the AI Office on compliance evaluations (Article 75(2)).

Article 50 applies since 2 August 2026, unchanged by Regulation (EU) 2026/1744, to providers and deployers of certain AI systems, including systems that interact with natural persons or generate synthetic content. The transparency obligations under Article 50 cover chatbots, the marking of synthetic content and deep fakes, and they bind the system provider and deployer, not the model provider as such.

General-Purpose AI Models: Related Questions

Chatbots, non-EU providers, the Digital Omnibus and Commission guidance raise four recurring questions about Articles 51 to 56.

Is ChatGPT a General-Purpose AI Model under the Act?

The act classifies models by Article 3(63) and Article 51, not by product name: a chatbot is an AI system, and the model behind it is a general-purpose AI model when it meets the definition.

The chatbot itself carries the Article 50 duty to tell natural persons that they interact with an AI system. Systemic risk turns on Article 51, through the compute presumption that triggers notification under Article 52 or through a Commission decision, and this guide classifies no named model.

Do Non-EU Model Providers Have to Comply?

Yes: Chapter V applies to model providers irrespective of where they are established once they place a model on the Union market (Article 2(1), point (a)).

The guide to the EU AI Act for non-EU companies explains how the act reaches them. Article 54 adds the written mandate for an authorised representative, except for open-source models without systemic risk.

Did the Digital Omnibus Change the Rules for Model Providers?

Regulation (EU) 2026/1744 replaced Article 56(6), Article 75(1) and parts of Article 97, but left Articles 51 to 55, Annexes XI to XIII and every model date unchanged.

The Digital Omnibus on AI explains what the regulation changed elsewhere, including the high-risk dates. The general Digital Omnibus proposal COM(2025) 837 is a separate text: it is pending in the European Parliament ("Awaiting committee decision" as of 24 October 2026) and does not amend the AI Act.

Which Commission Guidance Applies to Model Providers?

Commission guidelines C(2025) 7719 final of 19 November 2025, whose content was approved on 18 July 2025 by C(2025) 5045, explain scope and obligations; they are non-binding.

The register of EU AI Act guidelines lists them with every other Commission guideline. The training-content template presented on 24 July 2025 is mandatory for Article 53(1)(d) and is not part of the Code.

Frequently Asked Questions about General-Purpose AI Models

What is a general-purpose AI model?

An AI model that displays significant generality, competently performs a wide range of distinct tasks and can be integrated into a variety of downstream systems or applications (Article 3(63)). Models used only for research before placing on the market are excluded.

Since when do the rules for general-purpose AI models apply?

Chapter V applies since 2 August 2025. Commission enforcement and Article 101 fines apply since 2 August 2026, and models placed on the market before 2 August 2025 comply by 2 August 2027 (Article 111(3)).

Is the Code of Practice mandatory?

No. It is voluntary and gives no presumption of conformity; providers that do not sign show compliance by other adequate means, such as a gap analysis reported to the AI Office.

Who supervises providers of general-purpose AI models?

The Commission, exclusively, through the AI Office (Article 88(1)). National market surveillance authorities supervise the AI systems that third parties build on these models.

What fines can the Commission impose on model providers?

Up to 3 % of annual total worldwide turnover in the preceding financial year or EUR 15 million, whichever is higher (Article 101(1)), since 2 August 2026, with no SME reduction.

Do open-source general-purpose AI models have obligations?

Yes: the copyright policy and the training-content summary always apply, and models with systemic risk get no exception from any Chapter V duty.