Table of contents

Get notified when this article is updated

What is a GPAI Model?

Under Article 3(63) of the EU AI Act, a General Purpose AI (GPAI) model is an AI model trained on large amounts of data, designed to serve a variety of purposes, and which can be integrated into downstream systems or applications.

This explicitly includes: GPT-4, Claude, Gemini, Llama, Mistral, and any other large language model or multimodal foundation model used as a base layer in a product.

Who is Affected — Provider vs Deployer

GPAI Model Providers

OpenAI, Anthropic, Google, Meta, Mistral. Subject to the full Chapter V obligations: technical documentation, copyright policy, transparency to downstream providers.

Downstream Deployers

You, if you build on a GPAI model. Subject to Article 50 transparency obligations and potentially high-risk obligations if your use case falls under Annex III.

Article 53 — Obligations for GPAI Providers

•Maintain technical documentation covering training methodology, data used, compute resources

•Publish a sufficiently detailed summary of training data (copyright transparency)

•Comply with EU copyright law, specifically the Text and Data Mining exception

•Provide downstream providers with information needed for their own compliance

•Register in the EU AI Act database before market placement

Article 55 — Systemic Risk Models

GPAI models trained with more than 10²⁵ FLOPs are classified as systemic risk models (currently: GPT-4, Gemini Ultra, Claude 3 Opus, Llama 3 405B). Additional obligations apply:

•Adversarial testing and red-teaming before deployment

•Incident reporting to the European AI Office without undue delay (Art. 55(1)(c))

•Cybersecurity measures proportionate to systemic risk

•Energy consumption reporting

What Deployers Must Do in Practice

If you are building a product on a GPAI model, your obligations depend on your use case:

Use case NOT in Annex III

Article 50 applies: disclose to users that they are interacting with an AI system. For chatbots: clear disclosure at the start of each interaction.

Use case IS in Annex III (HR, credit, healthcare…)

The full high-risk regime applies to your system, even if the underlying model is not itself high-risk. You are the provider of a high-risk AI system.

Timeline

August 2, 2025GPAI obligations entered into force

NowGPAI model providers must be compliant: documentation, copyright policy, downstream transparency

August 2, 2026Article 50 transparency obligations apply (chatbot disclosure, GenAI labelling)

2 December 2027Annex III high-risk obligations apply to downstream deployers (post-Digital Omnibus, 7 May 2026 trilogue agreement)

Using a GPAI model in your product? The free Sprinkling Act diagnostic determines whether Article 50, Article 53, or the full high-risk regime applies to your system.

Free diagnostic — 9 questions See full report

Sources

[1]
EUR-Lex (July 12, 2024) — Regulation (EU) 2024/1689 — Artificial Intelligence Act (full text) eur-lex.europa.eu/eli
[2]
EU AI Act — Article 3 — Definitions (including GPAI model) artificialintelligenceact.eu/article
[3]
EU AI Act — Article 51 — Classification of General-Purpose AI Models as GPAI Models with Systemic Risk artificialintelligenceact.eu/article
[4]
EU AI Act — Article 53 — Obligations for Providers of General-Purpose AI Models artificialintelligenceact.eu/article
[5]
EU AI Act — Article 55 — Obligations for Providers of GPAI Models with Systemic Risk artificialintelligenceact.eu/article
[6]
EU AI Act — Article 50 — Transparency Obligations for Deployers artificialintelligenceact.eu/article
[7]
EU AI Act — Annex III — High-Risk AI Systems Referred to in Article 6(2) artificialintelligenceact.eu/annex
[8]
EU AI Act — Implementation Timeline artificialintelligenceact.eu/implementation-timeline

ALREADY ENFORCEABLE

Art. 5 prohibitions and GPAI rules apply today. Article 50 transparency binds 2 August 2026. Annex III high-risk binds 2 December 2027 (post-Omnibus). The question is not when: it’s whether you’ve documented your position.

Free Diagnostic — 9 questions See pricing →

Table of contents

Get notified when this article is updated

What is a GPAI Model?

This explicitly includes: GPT-4, Claude, Gemini, Llama, Mistral, and any other large language model or multimodal foundation model used as a base layer in a product.

Who is Affected — Provider vs Deployer

GPAI Model Providers

OpenAI, Anthropic, Google, Meta, Mistral. Subject to the full Chapter V obligations: technical documentation, copyright policy, transparency to downstream providers.

Downstream Deployers

You, if you build on a GPAI model. Subject to Article 50 transparency obligations and potentially high-risk obligations if your use case falls under Annex III.

Article 53 — Obligations for GPAI Providers

•Maintain technical documentation covering training methodology, data used, compute resources

•Publish a sufficiently detailed summary of training data (copyright transparency)

•Comply with EU copyright law, specifically the Text and Data Mining exception

•Provide downstream providers with information needed for their own compliance

•Register in the EU AI Act database before market placement

Article 55 — Systemic Risk Models

GPAI models trained with more than 10²⁵ FLOPs are classified as systemic risk models (currently: GPT-4, Gemini Ultra, Claude 3 Opus, Llama 3 405B). Additional obligations apply:

•Adversarial testing and red-teaming before deployment

•Incident reporting to the European AI Office without undue delay (Art. 55(1)(c))

•Cybersecurity measures proportionate to systemic risk

•Energy consumption reporting

What Deployers Must Do in Practice

If you are building a product on a GPAI model, your obligations depend on your use case:

Use case NOT in Annex III

Article 50 applies: disclose to users that they are interacting with an AI system. For chatbots: clear disclosure at the start of each interaction.

Use case IS in Annex III (HR, credit, healthcare…)

The full high-risk regime applies to your system, even if the underlying model is not itself high-risk. You are the provider of a high-risk AI system.

Timeline

August 2, 2025GPAI obligations entered into force

NowGPAI model providers must be compliant: documentation, copyright policy, downstream transparency

August 2, 2026Article 50 transparency obligations apply (chatbot disclosure, GenAI labelling)

2 December 2027Annex III high-risk obligations apply to downstream deployers (post-Digital Omnibus, 7 May 2026 trilogue agreement)

Using a GPAI model in your product? The free Sprinkling Act diagnostic determines whether Article 50, Article 53, or the full high-risk regime applies to your system.

Free diagnostic — 9 questions See full report

Sources

[1]
EUR-Lex (July 12, 2024) — Regulation (EU) 2024/1689 — Artificial Intelligence Act (full text) eur-lex.europa.eu/eli
[2]
EU AI Act — Article 3 — Definitions (including GPAI model) artificialintelligenceact.eu/article
[3]
EU AI Act — Article 51 — Classification of General-Purpose AI Models as GPAI Models with Systemic Risk artificialintelligenceact.eu/article
[4]
EU AI Act — Article 53 — Obligations for Providers of General-Purpose AI Models artificialintelligenceact.eu/article
[5]
EU AI Act — Article 55 — Obligations for Providers of GPAI Models with Systemic Risk artificialintelligenceact.eu/article
[6]
EU AI Act — Article 50 — Transparency Obligations for Deployers artificialintelligenceact.eu/article
[7]
EU AI Act — Annex III — High-Risk AI Systems Referred to in Article 6(2) artificialintelligenceact.eu/annex
[8]
EU AI Act — Implementation Timeline artificialintelligenceact.eu/implementation-timeline

ALREADY ENFORCEABLE

Free Diagnostic — 9 questions See pricing →

GPAI Obligations in 2026: What Every Company Using ChatGPT Must Know

What is a GPAI Model?

Who is Affected — Provider vs Deployer

Article 53 — Obligations for GPAI Providers

Article 55 — Systemic Risk Models

What Deployers Must Do in Practice

Timeline

Sources

GPAI Obligations in 2026: What Every Company Using ChatGPT Must Know

What is a GPAI Model?

Who is Affected — Provider vs Deployer

Article 53 — Obligations for GPAI Providers

Article 55 — Systemic Risk Models

What Deployers Must Do in Practice

Timeline

Sources