Direct answer: under the EU AI Act (Regulation (EU) 2024/1689), obligations for providers of general-purpose AI (GPAI) models have applied since 2 August 2025, and the Act has applied fully / entered full enforcement from 2 August 2026. GPAI providers must do at least four things: (1) draw up and maintain technical documentation (Annex XI); (2) provide downstream AI system providers with information on capabilities, limitations and compliance (Annex XII); (3) put in place a copyright compliance policy that identifies and respects rights reservations; and (4) publish a sufficiently detailed summary of training content using the AI Office template. Models presumed to have systemic risk (cumulative training compute above 10^25 FLOPs) must also perform model evaluation, adversarial testing, risk assessment and mitigation, incident reporting and cybersecurity. Third-country providers must appoint an EU authorised representative before placing a model on the EU market. Fines can reach 3% of worldwide annual turnover or EUR 15 million, whichever is higher.
This guide is for foundation-model/LLM providers, downstream AI system providers integrating GPAI, open-source model maintainers and teams offering model APIs or weight downloads in the EU. Data cut-off: 8 November 2026; sources are the European Commission AI Act page, the GPAI Code of Practice page and EUR-Lex Regulation (EU) 2024/1689 (consolidated version 27 July 2026). Official facts, editorial interpretation and items to confirm are kept separate. This is not legal advice.
(1) GPAI duties did not start in 2026: they have applied since 2 August 2025; 2 August 2026 is the AI Act's full application/enforcement milestone. (2) Open source is not a blanket exemption: models with public weights/parameters may be exempt from technical documentation and downstream information, but copyright policy and the training-data summary still apply, and the exemption does not cover models with systemic risk. (3) The systemic-risk threshold is a presumption above 10^25 FLOPs; notify the Commission within two weeks, and fines reach 3% of turnover or EUR 15 million, whichever is higher.
Timeline: GPAI duties, full application and legacy models
The AI Act entered into force on 1 August 2024; prohibitions have applied since 2 February 2025; GPAI obligations and governance have applied since 2 August 2025; Article 101 GPAI fines apply from 2 August 2026; the Act has applied fully since 2 August 2026 (with Annex I product-related high-risk obligations under Article 6(1) applying from 2 August 2027). For GPAI models placed on the market before 2 August 2025, providers must comply by 2 August 2027 (Article 111(3)). The 2026 question is therefore not "whether" but whether documentation, copyright policy, training-data summary and systemic-risk processes are auditable.
| Date | Event | What it means |
|---|---|---|
| 1 Aug 2024 | AI Act enters into force | Staged implementation begins |
| 2 Feb 2025 | Prohibitions apply | Unacceptable-risk AI practices banned |
| 2 Aug 2025 | GPAI obligations apply | Technical documentation, downstream information, copyright, training-data summary; Article 101 GPAI fines from 2 Aug 2026 |
| 2 Aug 2026 | Full application | Main AI Act obligations/enforcement fully apply; Article 101 GPAI fines apply |
| 2 Aug 2027 | Annex I high-risk + legacy GPAI | Product-related high-risk duties; compliance deadline for pre-2 Aug 2025 models |
Sources: Regulation (EU) 2024/1689 Articles 111 and 113 (consolidated 27 July 2026); European Commission AI Act page and GPAI Code of Practice page (accessed 8 November 2026). Specific application, transition and national enforcement follow the Regulation and competent authority requirements.
Who carries GPAI duties: providers, downstream, representatives
A GPAI model is a model with significant generality that can competently perform a wide range of distinct tasks and can be integrated into a variety of downstream systems/applications (including models trained with large amounts of data using self-supervision at scale). The provider (placing the model on the market or putting it into service, including via API or weight downloads) bears the Article 53/54/55 duties; a downstream AI system provider integrating the model bears its own duties as an AI system provider (including Chapter III high-risk duties where applicable); a third-country provider must appoint, by written mandate, an EU authorised representative before placing the model on the EU market, empowered to verify documentation, keep it for 10 years, provide information to the AI Office and cooperate. A free and open-source model can be exempt from Article 53(1)(a)(b) technical documentation and downstream information if it meets the public weights/parameters conditions, but not from copyright policy or the training-data summary, and the exemption does not apply to models with systemic risk.
| Role | Core duty | Check first |
|---|---|---|
| GPAI provider | Article 53 four duties; Article 55 for systemic risk | Whether the model is placed on the EU market/provided in the EU |
| Downstream AI system provider | Its own AI system provider duties; Chapter III if high-risk | Whether the use is high-risk; whether the model is modified |
| Third-country provider | Appoint an EU authorised representative (Article 54) | Whether it is established in the EU |
| Open-source maintainer | Copyright policy, training-data summary; partial exemption only | Licence, public weights/parameters, systemic risk |
| Systemic-risk provider | Evaluation, adversarial testing, mitigation, incident reporting, cybersecurity | Above 10^25 FLOPs or designated |
Sources: Regulation (EU) 2024/1689 Articles 3(63), 53, 54 and 55 and Annexes XI/XII (accessed 8 November 2026). This is an editorial summary; the GPAI definition, open-source exemption and role split require case-specific analysis.
Article 53: four baseline duties and evidence
Article 53(1) requires GPAI providers to: (a) technical documentation covering the training and testing process and evaluation results, containing at least the Annex XI information and provided to the AI Office/national authorities on request; (b) downstream information for AI system providers intending to integrate the model, covering capabilities, limitations and compliance information, with at least the Annex XII elements; (c) copyright policy to comply with EU copyright and related rights, including identifying and complying with rights reservations expressed under Article 4(3) of Directive (EU) 2019/790 (including through state-of-the-art technologies); and (d) training-data summary made publicly available, sufficiently detailed, using the AI Office template. Article 53(4) allows providers to demonstrate compliance through an approved Code of Practice or harmonised standards; otherwise they must demonstrate alternative adequate means to the Commission.
| Duty | Key point | Checkable evidence |
|---|---|---|
| Technical documentation | Training/testing process, evaluation results, Annex XI information | Model card, training logs, evaluation reports, version history |
| Downstream information | Capabilities/limitations, integration and compliance information (Annex XII) | Developer docs, API description, known limitations |
| Copyright policy | Identify/respect rights reservations (TDM opt-out) | Copyright policy, data-source list, opt-out handling records |
| Training-data summary | Sufficiently detailed public summary using the AI Office template | Public summary page, template fields, update log |
| Compliance route | Code of Practice / harmonised standards / other adequate means | Adoption record, gap assessment, alternative evidence |
Sources: Regulation (EU) 2024/1689 Article 53 and Annexes XI/XII (accessed 8 November 2026); European Commission GPAI Code of Practice page and training-data summary template. This is an editorial summary; the required depth, template fields and "sufficiently detailed" test follow the official template/guidance.
Systemic risk: 10^25 FLOPs, two-week notification, evaluation and incident reporting
Article 51 classifies a GPAI model as having systemic risk if it has high-impact capabilities or the Commission so decides; a model is presumed to have high-impact capabilities when cumulative training compute exceeds 10^25 FLOPs. A provider meeting that threshold must notify the Commission without delay and in any event within two weeks, and may submit substantiated arguments that the model, due to its specific characteristics, does not present systemic risk (the Commission assesses them). Systemic-risk models must also, under Article 55: perform model evaluation and adversarial testing using standardised protocols/tools reflecting the state of the art; assess and mitigate systemic risks at EU level; keep track of, document and report serious incidents without undue delay to the AI Office and, as appropriate, national authorities; and ensure adequate cybersecurity protection. The Code of Practice can help demonstrate compliance but is not the only route.
| Requirement | Trigger/deadline | Evidence |
|---|---|---|
| Systemic-risk presumption | Cumulative training compute above 10^25 FLOPs | Compute calculation, training records |
| Notify the Commission | Within two weeks of meeting the threshold | Notification copy, substantiated arguments |
| Model evaluation/adversarial testing | Standardised protocols/tools, state of the art | Evaluation plan, red-team report, reproducibility records |
| Risk mitigation | EU-level systemic risk assessment and mitigation | Risk register, mitigations, residual risk |
| Incident reporting | Serious incidents without undue delay | Incident log, reports |
| Cybersecurity | Adequate protection | Security controls, penetration tests, access control |
Sources: Regulation (EU) 2024/1689 Articles 51, 52 and 55 (accessed 8 November 2026). This is an editorial summary; "high-impact capabilities", notification arguments and incident-reporting details follow the Regulation and Commission guidance/Code of Practice.
Compliance routes: Code of Practice, standards and alternatives
The GPAI Code of Practice is a voluntary tool facilitated by the Commission and drafted by independent experts, detailing the Article 53/55 rules; the first Code has been received by the Commission. Providers may sign/adopt the Code to demonstrate compliance; they may also rely on harmonised standards for a presumption of conformity; where neither applies, they must demonstrate alternative adequate means to the Commission. The AI Office has also provided a template for the training-data summary; for copyright, rights reservations (such as TDM opt-outs) must be integrated into data collection/training. The 2026 priority is to turn policy documents into a reproducible evidence chain: model versions, data sources, opt-out handling, evaluation results and incident records traceable to a specific model.
| Route | Purpose | Watch out |
|---|---|---|
| GPAI Code of Practice | Details Articles 53/55; signing/adopting can demonstrate compliance | Voluntary; build evidence under the Code, not just sign |
| Harmonised standards | Presumption of conformity | Only to the extent the standard covers the obligation |
| Other adequate means | Alternative proof if no Code/standard | Must be demonstrated to the Commission; heavier burden |
| Training-data summary template | Standardises the Article 53(1)(d) public summary | Use the template fields and keep them updated |
| Copyright policy | Identify/respect rights reservations | Keep records of data sources, crawlers and opt-out handling |
Sources: European Commission GPAI Code of Practice page and Regulation (EU) 2024/1689 Articles 53(4) and 56 (accessed 8 November 2026). This is an editorial summary; the latest Code/standard status and scope follow the official pages.
90-day implementation checklist
Use the first 90 days to connect the model inventory, roles, documentation, copyright, training-data summary and systemic-risk evidence. The order is: model/role inventory, documentation and downstream information, copyright/data summary, systemic-risk determination, Code/standard gap assessment, evidence and drills.
| Phase | Action | Output |
|---|---|---|
| Weeks 1-2 | Inventory GPAI models, versions, distribution and EU market placement | Model inventory, role matrix |
| Weeks 2-4 | Complete Annex XI technical documentation and Annex XII downstream information | Model card, evaluation reports, developer docs |
| Weeks 3-5 | Build copyright policy and TDM opt-out handling | Copyright policy, data-source/opt-out register |
| Weeks 4-6 | Publish the training-data summary using the AI Office template | Public summary page, update log |
| Weeks 5-8 | Determine systemic risk (above 10^25 FLOPs/designation); build two-week notification process | Compute calculation, notification template |
| Weeks 7-10 | Model evaluation/adversarial testing/risk mitigation/incident reporting/cybersecurity | Red-team report, risk register, incident log |
| Weeks 9-12 | Gap assessment against the Code/standards and evidence pack | Gap list, remediation plan, management review |
Editorial implementation advice, not an official template; specific documentation, evaluation, incident reporting and Code/standard requirements follow the AI Act, Commission guidance/Code and competent authority requirements.
FAQ
Do GPAI obligations apply now?
Yes. GPAI obligations have applied since 2 August 2025; Article 101 GPAI fines apply from 2 August 2026; the AI Act has applied fully since 2 August 2026. GPAI models placed on the market before 2 August 2025 must comply by 2 August 2027.
What counts as a GPAI model?
Article 3(63) defines it as a model with significant generality that can competently perform a wide range of distinct tasks and can be integrated into a variety of downstream systems/applications, including models trained with large amounts of data using self-supervision at scale. It is not determined by parameter count alone, and not every foundation model is automatically high-risk; high-risk depends on the downstream use.
Are open-source models exempt?
Partly. A free and open-source model that allows access, use, modification and distribution and publicly releases its weights, architecture and usage information can be exempt from Article 53(1)(a)(b) technical documentation and downstream information. It is not exempt from copyright policy or the training-data summary, and the exemption does not apply to models with systemic risk.
What is the systemic-risk threshold?
A model is presumed to have high-impact capabilities/systemic risk when cumulative training compute exceeds 10^25 FLOPs; the Commission may also designate a model ex officio or following a qualified alert from the scientific panel. A provider meeting the threshold must notify the Commission within two weeks and may submit substantiated arguments that the model does not present systemic risk.
What must a Chinese model provider do?
A third-country provider must appoint, by written mandate, an EU authorised representative before placing a GPAI model on the EU market; the representative must be able to verify Annex XI documentation, keep it for 10 years, provide information to the AI Office on request and cooperate. The provider must also meet the Article 53/55 duties as applicable.
Is the Code of Practice mandatory?
No. It is a voluntary tool; signing/adopting it can help demonstrate compliance with Articles 53/55. Providers may instead rely on harmonised standards for a presumption of conformity; if neither applies, they must demonstrate alternative adequate means to the Commission. Check the official page for the latest Code status and signatories.
What are the fines?
For GPAI providers, the Commission may impose fines under Article 101 of up to 3% of worldwide annual turnover or EUR 15 million, whichever is higher; other infringements (such as prohibited practices) have higher ceilings. Specific amounts/procedures depend on the infringement, circumstances and Commission decision.
How do GPAI and high-risk AI relate?
GPAI providers bear Chapter V duties; a downstream provider integrating a GPAI model into a high-risk AI system still bears its own Chapter III duties as an AI system provider (risk management, data governance, technical documentation, human oversight, conformity assessment, etc.). The roles differ and the duties are not interchangeable.
Research method and limitations
This article separates "official facts" from "editorial advice": the GPAI obligations applying from 2 August 2025, full application from 2 August 2026, legacy transition on 2 August 2027, Articles 53/54/55, the 10^25 FLOPs presumption, two-week notification and Article 101 fines come from EUR-Lex Regulation (EU) 2024/1689 (consolidated 27 July 2026); the Code of Practice, training-data summary template and AI Act risk/enforcement information come from the European Commission AI Act page and GPAI Code of Practice page. The 90-day list and the "evidence/action" columns are editorial.
Eight limitations: (1) this is not legal advice; (2) the consolidated AI Act, guidance and Code are still evolving, so the latest official text governs; (3) national competent authorities, penalty practice and AI Office enforcement are not checked country by country; (4) the GPAI definition, open-source exemption and systemic-risk arguments are highly fact-specific; (5) the article does not cover every Annex XI/XII field or every Code chapter; (6) it does not map GPAI against high-risk AI, GDPR, CRA or the Data Act clause by clause; (7) no complete technical documentation template or evaluation tool is provided; (8) model capability/compute/incident-reporting judgements require specific facts and professional advice.
Sources and basis
- European Commission, AI Act: digital-strategy.ec.europa.eu/en/policies/regulatory-framework-ai. Risk tiers, prohibited practices, GPAI, enforcement and AI Act Service Desk. Accessed 8 November 2026.
- European Commission, Drawing-up a General-Purpose AI Code of Practice: digital-strategy.ec.europa.eu/en/policies/ai-code-practice. GPAI rules apply from 2 August 2025; Code details Articles 53/55; training-data summary template. Accessed 8 November 2026.
- EUR-Lex, Regulation (EU) 2024/1689 (AI Act, consolidated 27 July 2026): eur-lex.europa.eu/eli/reg/2024/1689/oj. Article 3(63) definition, Articles 51/52/53/54/55/56, Articles 99/101 penalties, Articles 111/113 application dates. Accessed 8 November 2026.
- European Commission, Guidelines on the scope of obligations for providers of general-purpose AI models under the AI Act: digital-strategy.ec.europa.eu/en/library/guidelines-scope-obligations-providers-general-purpose-ai-models-under-ai-act. Scope of GPAI obligations, roles and implementation guidance. Accessed 8 November 2026.
Data cut-off 8 November 2026; based on official pages and the Regulation; not legal advice; specific obligations follow the AI Act, Commission guidance/Code, the AI Office and national competent authorities.