We use cookies to improve your experience and analyse site traffic.
The EU AI Act creates a dedicated regime for general-purpose AI — Articles 51 through 56. Every GPAI provider faces documentation, transparency, and copyright obligations. Those with systemic risk face additional requirements: adversarial testing, incident reporting, and cybersecurity protections.
Provider Obligations
Six core obligations that apply to all general-purpose AI model providers, regardless of systemic risk classification.
Systemic Risk
GPAI models above the compute threshold — or designated by the Commission — face additional obligations beyond the standard GPAI requirements.
| Threshold | Classification | Obligations |
|---|---|---|
| Cumulative compute > 10^25 FLOP | Systemic Risk | Automatic classification as GPAI with systemic risk. Providers must perform model evaluation, adversarial testing, track and report serious incidents, and ensure adequate cybersecurity protections. |
| Commission designation | Systemic Risk | The Commission may designate a GPAI model as having systemic risk based on impact criteria — even below the compute threshold. Number of registered users, cross-border reach, and interconnectedness are considered. |
| Below compute threshold | Standard GPAI | Standard obligations apply: technical documentation, downstream provider information, copyright compliance, training data summary. No adversarial testing or incident reporting required unless designated. |
| Open-source models | Reduced Obligations | Open-source GPAI models (excluding systemic risk) benefit from reduced obligations — mainly training data summary and copyright compliance. Full documentation requirements do not apply. |
Navigate Articles 51-56 — structured guidance for foundation model providers on documentation, evaluation, systemic risk assessment, and codes of practice.