Is my GPT/Claude wrapper a GPAI? And am I a provider or a deployer?

1. What is a GPAI, precisely?

Article 3(63) of the AI Act defines a GPAI model (General Purpose AI) as an AI model trained on large amounts of data, designed to serve a variety of purposes, capable of performing a wide range of distinct tasks, and which can be integrated into downstream systems or applications.

Recital 97 clarifies: the relevant models are those with at least 10²³ FLOPs of training compute, capable of generating language (text or audio), text-to-image or text-to-video. This explicitly captures: GPT-4, GPT-3.5, Claude (all versions), Gemini (all versions), Llama, Mistral, and equivalent foundation models.

2. Provider or deployer? Both at once.

This is the most misunderstood point. When you build a SaaS product that calls GPT-4 via the OpenAI API, you simultaneously hold two distinct roles:

Direct consequence: your obligations depend on what YOUR system does, not on what the underlying model is capable of. A wrapper that filters CVs is an Annex III high-risk system (§4(b), employment). A wrapper that generates cat images is not.

3. When do you become a provider of the GPAI model itself?

Article 25 of the AI Act defines responsibilities along the value chain. It specifies that if you substantially modify an AI system already on the market (including a GPAI), you become its provider for AI Act purposes. Concretely:

4. What this actually costs you

The range depends entirely on the regime you fall under. Here are the sourced orders of magnitude from the CEPS 2021 report and market estimates for deployers:

Important: if you already have GDPR maturity (DPO, records, DPIAs), the marginal cost of the AI Act is lower, because it extends existing governance rather than reinventing it. We do not put a figure on that reduction: we have not measured it, and we know of no source establishing it for a European SME.

5. What to do now

1. 1. Clarify your role. Deployer of the model AND provider of your system, most likely. Document this position in writing, for yourself, your team, your investors.
2. 2. Identify your use case in Annex III. If your product touches employment, credit, education, public services, justice, asylum, biometrics, or health, you may be high-risk.
3. 3. Check Art. 5 (prohibited practices). Emotion recognition in workplaces, social scoring, criminal profiling are prohibited, regardless of the underlying model.
4. 4. If you're limited risk: apply Art. 50. Transparency obligation: tell the user they're interacting with AI. Often that's all you need.
5. 5. Document EVERYTHING. The regulator doesn't check what you did, they check what you can prove. A dated artefact of your position is worth a thousand conversations.